# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:08:24 dovecot_login authenticator failed for H=(Sfg3Fu) [185.169.4.24]:60422: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.215.126
country_id: 1814991
description:
2026-02-01 03:08:13 dovecot_login authenticator failed for H=([121.204.215.126]) [121.204.215.126]:54178: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:08:20 dovecot_login authenticator failed for H=(gRX35bW) [158.94.208.175]:65176: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:08:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:08:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:09:38 dovecot_login authenticator failed for H=(UJxK8c2S) [185.169.4.24]:49694: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:09:10 dovecot_login authenticator failed for H=(xTx6NNLc) [2.58.56.77]:55031: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:09:15 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58305: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:09:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59393: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:09:42 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:63841: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.155
country_id: 2186224
description:
2026-02-01 03:09:58 dovecot_login authenticator failed for H=(ADMIN) [179.61.240.155]:28353: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:09:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:09:39 dovecot_login authenticator failed for H=(MWlFPKZ) [77.83.39.134]:61154: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:09:02 dovecot_login authenticator failed for H=(dN8ZC5XXV) [158.94.208.175]:63237: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:09:03 dovecot_login authenticator failed for H=(hOJa0AYM) [77.83.39.134]:60038: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:10:15 dovecot_login authenticator failed for H=(i9aSnC) [185.169.4.24]:54641: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:10:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:10:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56257: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:10:22 dovecot_login authenticator failed for H=(QVkyDiDO1) [2.58.56.77]:58896: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.169.81
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2259631427.jpg&size=1000x1000 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:10:15 dovecot_login authenticator failed for H=(xqOegHct) [158.94.208.175]:61689: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:10:15 dovecot_login authenticator failed for H=(HBsa7j4d) [77.83.39.134]:62121: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:10:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:10:25 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:59731: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:11:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54086: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:11:33 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:58811: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:11:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:11:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 03:11:32 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:40951: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:11:05 dovecot_login authenticator failed for H=(OwNrOmr) [2.58.56.77]:50132: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:11:10 dovecot_login authenticator failed for H=(ok5uPhMY8) [158.94.208.175]:58042: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-02-01 03:11:37 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (radjuts) [24.1.200.187]:34174: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:11:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:11:11 dovecot_login authenticator failed for H=(8Ls7KLw) [77.83.39.134]:63645: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-01 03:11:45 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:54838: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:11:28 dovecot_login authenticator failed for H=(TZ5CNZ6) [185.169.4.24]:51724: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:12:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:12:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.176.176.172
country_id: 2542007
description:
2026-02-01 03:12:08 dovecot_login authenticator failed for H=(WjI5tvW) [160.176.176.172]:25902: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-02-01 03:12:36 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (nocie) [98.227.25.115]:39562: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:12:06 dovecot_login authenticator failed for H=(wxp0goCu12) [77.83.39.134]:49161: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:12:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:12:10 dovecot_login authenticator failed for H=(DhKoCG6) [158.94.208.175]:58095: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:12:14 dovecot_login authenticator failed for H=(Hlz6qFaE) [2.58.56.77]:62337: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:12:06 dovecot_login authenticator failed for H=(I2xkiwAeIu) [185.169.4.24]:57616: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:13:32 dovecot_login authenticator failed for H=(wyhI2vR) [185.169.4.24]:51198: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:13:06 dovecot_login authenticator failed for H=(nAbjCn) [158.94.208.175]:58889: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:13:18 dovecot_login authenticator failed for H=(N6apngIB) [2.58.56.77]:50380: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-01 03:13:27 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:11686: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.17.192
country_id: 1562822
description:
2026-02-01 03:13:37 dovecot_plain authenticator failed for H=(hdqaruo9ncw3tujp5) [103.161.17.192]:19900: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 03:13:43 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:56160: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:13:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:13:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:13:18 dovecot_login authenticator failed for H=(CSXChws8) [77.83.39.134]:52068: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:13:24 dovecot_login authenticator failed for H=(L4VZKYpYT) [158.94.208.175]:61587: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sliders/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
country_id: 1814991
description:
2026-02-01 03:14:36 dovecot_login authenticator failed for H=([110.189.153.136]) [110.189.153.136]:42660: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.126
country_id: 2017370
description:
2026-02-01 03:14:45 dovecot_login authenticator failed for H=([178.178.194.126]) [178.178.194.126]:52846: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:14:12 dovecot_login authenticator failed for H=(CRIBM1j) [77.83.39.134]:54155: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-02-01 03:14:40 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:37355: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:14:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:14:10 dovecot_login authenticator failed for H=(fOjuZFm) [158.94.208.175]:65320: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.72.200
country_id: 2017370
description:
2026-02-01 03:14:30 dovecot_login authenticator failed for H=broadband-188-32-72-200.ip.moscow.rt.ru [188.32.72.200]:56176: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.115.9
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83291516687616 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.208.245
country_id: 1835841
description:
2026-02-01 03:14:12 dovecot_login authenticator failed for H=([121.171.208.245]) [121.171.208.245]:46884: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 03:14:35 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:52072: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:14:07 dovecot_login authenticator failed for H=(Yty6Pj3Bp) [185.169.4.24]:62286: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:14:24 dovecot_login authenticator failed for H=(246CFt) [2.58.56.77]:65154: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-02-01 03:14:49 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:37709: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 03:14:56 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:57939: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:15:07 dovecot_login authenticator failed for H=(z7xP3Y) [77.83.39.134]:56623: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-02-01 03:15:16 dovecot_login authenticator failed for H=(7PLHSi) [185.169.4.24]:65465: 535 Incorrect authentication data (set_id=jshah.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-02-01  3:15:40 198320 [Warning] Aborted connection 198320 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:15:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:15:11 dovecot_login authenticator failed for H=(71dF6BoDz) [2.58.56.77]:61220: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 03:15:06 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:57559: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:15:06 dovecot_login authenticator failed for H=(uEFOMMOs) [158.94.208.175]:57351: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.85.10
country_id: 1819730
domain: mail.modern.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/modern/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-02-01 03:15:01 dovecot_login authenticator failed for H=([223.26.225.129]) [210.206.24.234]:30352: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.187.24.97
country_id: 2017370
description:
2026-02-01 03:15:22 dovecot_login authenticator failed for H=([46.187.24.97]) [46.187.24.97]:58702: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:15:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62706: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.35
country_id: 1733045
description:
2026-02-01 03:15:15 dovecot_login authenticator failed for H=([49.124.151.35]) [49.124.151.35]:47808: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:16:18 dovecot_login authenticator failed for H=(UqTx1aUYJO) [2.58.56.77]:64415: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:16:19 dovecot_login authenticator failed for H=(iDCb7nfb) [158.94.208.175]:63986: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-02-01 03:16:22 dovecot_login authenticator failed for H=(abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:6517: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/monthly-report.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:16:23 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62931: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:16:25 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55282: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:16:38 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62838: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:16:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:16:59 dovecot_login authenticator failed for H=(bKbcpOb) [77.83.39.134]:60531: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:16:05 dovecot_login authenticator failed for H=(uGNwVg) [77.83.39.134]:58987: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.122
country_id: 1210997
description:
2026-02-01 03:16:13 dovecot_login authenticator failed for H=([49.0.36.122]) [49.0.36.122]:55054: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:17:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58225: 535 Incorrect authentication data (set_id=testing@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:17:08 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:63703: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:17:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.222.41.67
country_id: 1814991
description:
2026-02-01 03:17:06 dovecot_login authenticator failed for H=([183.222.41.67]) [183.222.41.67]:43784: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2026-02-01 03:17:14 dovecot_login authenticator failed for H=(92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:60450: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:17:08 dovecot_login authenticator failed for H=(LDXH0pMYx) [158.94.208.175]:51913: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-02-01 03:17:56 dovecot_login authenticator failed for H=([125.19.171.114]) [152.52.192.162]:52636: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:17:02 dovecot_login authenticator failed for H=(ueOa1F) [2.58.56.77]:53493: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2026-02-01 03:17:10 dovecot_plain authenticator failed for H=c-98-192-74-183.hsd1.ga.comcast.net (untle) [98.192.74.183]:53982: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:17:17 dovecot_login authenticator failed for H=(MQ3BXftP) [77.83.39.134]:61163: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:17:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 03:17:33 dovecot_plain authenticator failed for H=(tommic) [64.72.74.162]:55964: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:18:01 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:64470: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-02-01 03:18:11 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:11367: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:18:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:18:06 dovecot_login authenticator failed for H=(BPPg2SS) [158.94.208.175]:49826: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:18:12 dovecot_login authenticator failed for H=(AwKm8IDtDe) [77.83.39.134]:63415: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.12.182.16
country_id: 6252001
description:
2026-02-01 03:18:30 dovecot_login authenticator failed for H=(Host-By.DMIT.com) [154.12.182.16]:41152: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.25.236.147
country_id: 2017370
description:
2026-02-01 03:18:49 dovecot_login authenticator failed for H=([217.25.236.147]) [217.25.236.147]:60722: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:18:08 dovecot_login authenticator failed for H=(uzr4RgBxZw) [2.58.56.77]:59098: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: mssa.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:18:24 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65260: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:19:05 dovecot_login authenticator failed for H=(YS4mobSK) [158.94.208.175]:51707: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:19:17 dovecot_login authenticator failed for H=(n72qFD6NN) [2.58.56.77]:60822: 535 Incorrect authentication data (set_id=stacy)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 03:19:40 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:53654: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.142.26
country_id: 1835841
description:
2026-02-01 03:19:49 dovecot_login authenticator failed for H=([175.208.142.26]) [175.208.142.26]:57996: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-02-01 03:19:59 dovecot_login authenticator failed for H=([61.97.17.208]) [61.97.17.208]:51288: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.63.146.109
country_id: 3469034
domain: myfurnitureshop.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68719.myfurnitureshop.com.my||ServerName:myfurnitureshop.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b317c27ced9a206d2739e0e66502cfb0dee26308||Title:0x36a8c8dd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:19:06 dovecot_login authenticator failed for H=(JrZsiK) [77.83.39.134]:65519: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2026-02-01 03:19:11 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:2471: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:19:41 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:61548: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:20:01 dovecot_login authenticator failed for H=(9veuDdf) [158.94.208.175]:62312: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-02-01 03:20:04 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:56520: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 03:20:05 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:60506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:20:22 dovecot_login authenticator failed for H=(Hhg3hdv2aC) [158.94.208.175]:63451: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:20:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2026-02-01 03:20:02 dovecot_login authenticator failed for H=([218.25.233.2]) [218.25.233.22]:40545: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:20:15 dovecot_login authenticator failed for H=(eUq7ZYcF) [178.16.54.22]:60008: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:20:18 dovecot_login authenticator failed for H=(ksvJi1V) [77.83.39.134]:51634: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:20:22 dovecot_login authenticator failed for H=(U0DhoXvE) [2.58.56.77]:51432: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:20:31 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:62676: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 03:21:00 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:38766: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:21:06 dovecot_login authenticator failed for H=(9RDzxIe) [2.58.56.77]:56175: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:21:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:21:04 dovecot_login authenticator failed for H=(dN3jGXN) [158.94.208.175]:59014: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:21:04 dovecot_login authenticator failed for H=(v75ICCv) [178.16.54.22]:52963: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:21:12 dovecot_login authenticator failed for H=(JvEuhsTsdI) [77.83.39.134]:53618: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 03:21:19 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:39971: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:22:16 dovecot_login authenticator failed for H=(pnU2BAmdT) [178.16.54.22]:64659: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:22:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:22:23 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:60553: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:22:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58000: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:22:06 dovecot_login authenticator failed for H=(P2cyS6) [77.83.39.134]:55500: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:22:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:22:13 dovecot_login authenticator failed for H=(bglTSJe02) [2.58.56.77]:55918: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-02-01 03:22:55 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:57151: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:22:01 dovecot_login authenticator failed for H=(KCtC2dWjoi) [158.94.208.175]:49541: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:23:01 dovecot_login authenticator failed for H=(e7LSvX1H5) [158.94.208.175]:50907: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-02-01 03:23:20 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:35343: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:23:01 dovecot_login authenticator failed for H=(taOvZ1z7p4) [77.83.39.134]:57745: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:23:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:23:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:23:01 dovecot_login authenticator failed for H=(EyrQ1Dt6F) [158.94.208.175]:59948: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:23:01 dovecot_login authenticator failed for H=(ZCTiUcWgc) [2.58.56.77]:52938: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:23:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60329: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:23:09 dovecot_login authenticator failed for H=(fn5cPIvtW) [178.16.54.22]:57739: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:24:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:24:22 dovecot_login authenticator failed for H=(7Foj9PXUq) [178.16.54.22]:60253: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:24:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56076: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 03:24:44 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:38628: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:24:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59111: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 03:24:40 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:15028: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 03:24:58 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:48051: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:24:01 dovecot_login authenticator failed for H=(HJu1S3O5V) [158.94.208.175]:54779: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:24:09 dovecot_login authenticator failed for H=(6RfZwLG) [2.58.56.77]:53014: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:24:13 dovecot_login authenticator failed for H=(YjbPwBSoav) [77.83.39.134]:60443: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:24:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:24:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:25:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:25:17 dovecot_login authenticator failed for H=(NWliSR1i8S) [2.58.56.77]:57001: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:25:09 dovecot_login authenticator failed for H=(wGQSBKW5C) [178.16.54.22]:60360: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:25:01 dovecot_login authenticator failed for H=(TqPb4Fh97) [158.94.208.175]:52753: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:25:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:25:07 dovecot_login authenticator failed for H=(3zNwRFUBu9) [77.83.39.134]:62433: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:25:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:26:14 dovecot_login authenticator failed for H=(3L4K4Oa) [158.94.208.175]:57331: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-02-01 03:26:59 H=([45.144.212.50]) [45.144.212.50]:57946 F=<ccmsservice@bangkokbank.com> rejected RCPT <astkbr@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:26:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:26:21 dovecot_login authenticator failed for H=(cLqbNr) [178.16.54.22]:58792: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 03:26:47 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:57258: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:26:01 dovecot_login authenticator failed for H=(UJDnjg8) [77.83.39.134]:64549: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-02-01 03:26:23 dovecot_login authenticator failed for H=([118.183.180.108]) [118.183.180.108]:43780: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-02-01 03:26:36 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:39010: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:26:50 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63072: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 03:26:59 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:60900: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:26:05 dovecot_login authenticator failed for H=(KVuVOHyIi) [2.58.56.77]:61552: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:26:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:26:17 dovecot_login authenticator failed for H=(71Zo0uX) [158.94.208.175]:59373: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:27:13 dovecot_login authenticator failed for H=(CdCp7tv7FP) [77.83.39.134]:51199: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/login.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:27:11 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:50331: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 45.8.19.188
country_id: 6252001
domain: saps.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:27:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 03:27:52 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:56634: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:27:01 dovecot_login authenticator failed for H=(GVSu5uagY0) [158.94.208.175]:55493: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:27:10 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50240: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:27:11 dovecot_login authenticator failed for H=(nwQmHjhCN) [2.58.56.77]:63202: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 03:27:58 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:46921: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:27:10 dovecot_login authenticator failed for H=(ygj8lA6e2) [178.16.54.22]:52159: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 45.8.19.192
country_id: 6252001
domain: saps.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/shop/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:28:23 dovecot_login authenticator failed for H=(1pOWhJDxr6) [2.58.56.77]:53124: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:28:29 dovecot_login authenticator failed for H=(5KbfZW) [158.94.208.175]:56857: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:28:20 dovecot_login authenticator failed for H=(6YiFV0) [178.16.54.22]:55765: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 03:28:29 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:41326: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/rpl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:28:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 03:28:19 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:60772: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:28:13 dovecot_login authenticator failed for H=(F9Mwi1lL) [158.94.208.175]:62681: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:28:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:28:10 dovecot_login authenticator failed for H=(SFrKouU) [77.83.39.134]:53537: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:28:59 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55745: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:28:47 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54074: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.134
country_id: 690791
description:
2026-02-01 03:29:04 dovecot_login authenticator failed for H=(UvR2kRhmv) [77.83.39.134]:55619: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-01 03:29:07 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:49524: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:29:09 dovecot_login authenticator failed for H=(8gIyHdxs) [178.16.54.22]:60841: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:29:10 dovecot_login authenticator failed for H=(rUplUy6fO) [158.94.208.175]:53787: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:29:49 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:54976: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.134
country_id: 690791
description:
Feb  1 03:29:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 77.83.39.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:29:07 dovecot_login authenticator failed for H=(jf5GaWlas) [2.58.56.77]:55292: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:29:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59818: 535 Incorrect authentication data (set_id=testing@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:30:11 dovecot_login authenticator failed for H=(sLIeVCFCGb) [158.94.208.175]:55807: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2026-02-01 03:30:14 dovecot_login authenticator failed for H=(nsg-corporate-57.181.187.122.airtel.in) [182.95.174.178]:44684: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2026-02-01 03:30:44 dovecot_login authenticator failed for H=([103.163.44.118]) [103.163.44.118]:50738: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-02-01 03:30:48 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:34631: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-02-01 03:30:17 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:53046: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.255.5
country_id: 1814991
description:
2026-02-01 03:30:32 dovecot_login authenticator failed for H=([118.122.255.5]) [118.122.255.5]:17068: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:30:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:30:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59220: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:30:15 dovecot_login authenticator failed for H=(PofvZK7YM) [2.58.56.77]:55095: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:30:21 dovecot_login authenticator failed for H=(HFzlK9V6c) [178.16.54.22]:51163: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:30:28 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:50382: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:30:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54001: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 03:31:37 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:60240: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:31:06 dovecot_login authenticator failed for H=(RhsFkX) [158.94.208.175]:54609: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:31:19 dovecot_login authenticator failed for H=(kAc9lQsR) [2.58.56.77]:51810: 535 Incorrect authentication data (set_id=stacy)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.95
country_id: 1814991
description:
2026-02-01 03:31:55 dovecot_login authenticator failed for H=([27.24.141.95]) [27.24.141.95]:52898: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:31:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-01 03:31:24 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:49568: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:32:00 dovecot_login authenticator failed for H=(ITSuOlXDN) [158.94.208.175]:61869: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:31:07 dovecot_login authenticator failed for H=(WSxxB7L) [178.16.54.22]:59344: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-02-01 03:31:33 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:48892: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:32:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:32:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62887: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:32:16 dovecot_login authenticator failed for H=(ZBNo7IY65) [178.16.54.22]:54690: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:32:16 dovecot_login authenticator failed for H=(00CEwaEBf) [158.94.208.175]:63037: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.211.39.144
country_id: 2017370
description:
2026-02-01 03:32:31 dovecot_login authenticator failed for H=([195.211.39.144]) [195.211.39.144]:51050: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 03:32:19 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:36418: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 03:32:17 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:49697: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-01 03:32:33 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:37860: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2026-02-01 03:32:39 dovecot_login authenticator failed for H=(nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:56817: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:32:50 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52950: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:32:05 dovecot_login authenticator failed for H=(5VLvu9) [2.58.56.77]:63272: 535 Incorrect authentication data (set_id=stacy)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.62.84.30
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/mockery/index.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:33:04 dovecot_login authenticator failed for H=(aZj9UVaJRC) [178.16.54.22]:58800: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:33:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:33:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:33:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:33:11 dovecot_login authenticator failed for H=(O8pAuqEAd) [158.94.208.175]:64838: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:33:15 dovecot_login authenticator failed for H=(pBhYChj) [2.58.56.77]:64457: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:34:14 dovecot_login authenticator failed for H=(YR6LXiWX) [178.16.54.22]:50812: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:34:17 dovecot_login authenticator failed for H=(hHjtI95) [158.94.208.175]:55671: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:34:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.213.24.24
country_id: 2077456
domain: manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/manfotp3/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:34:02 dovecot_login authenticator failed for H=(nq9QQML) [2.58.56.77]:60449: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:34:31 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62560: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:34:17 dovecot_login authenticator failed for H=(rglzOfP42g) [158.94.208.175]:55113: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:34:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:35:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:35:23 dovecot_login authenticator failed for H=(DZ7VEYDyQ) [178.16.54.22]:57675: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 03:35:39 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:35244: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:35:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:35:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:35:04 dovecot_login authenticator failed for H=(tleTJQ5wgF) [2.58.56.77]:62375: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:35:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50648: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:35:04 dovecot_login authenticator failed for H=(ZVx7sUIPK) [158.94.208.175]:60453: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 03:35:58 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:39141: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:35:45 dovecot_login authenticator failed for H=(5JZTj8) [158.94.208.175]:59865: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:36:20 dovecot_login authenticator failed for H=(0B0XRPEzIh) [158.94.208.175]:57166: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-02-01 03:36:29 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:39883: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 03:36:40 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:55270: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:36:09 dovecot_login authenticator failed for H=(1KaGzg) [178.16.54.22]:58043: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:36:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55556: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:36:14 dovecot_login authenticator failed for H=(D29y2m5T4n) [2.58.56.77]:50654: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2026-02-01 03:36:53 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:32995: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:36:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:36:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-02-01 03:37:04 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:52493: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:37:02 dovecot_login authenticator failed for H=(8ApxsVXHDV) [158.94.208.175]:54907: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:37:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:37:18 dovecot_login authenticator failed for H=(zhrciTE) [178.16.54.22]:56676: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:37:19 dovecot_login authenticator failed for H=(nPAwLKw) [2.58.56.77]:61481: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:37:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:38:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.31.218
country_id: 1835841
description:
2026-02-01 03:38:16 dovecot_login authenticator failed for H=([59.9.31.218]) [59.9.31.218]:50792: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-02-01 03:38:59 dovecot_login authenticator failed for H=([211.53.58.1]) [211.169.212.206]:52824: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-02-01 03:38:26 dovecot_login authenticator failed for H=([185.101.16.250]) [185.101.16.250]:36705: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-02-01 03:38:52 dovecot_login authenticator failed for H=([65.20.233.110]) [65.20.233.110]:60635: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.18
country_id: 1269750
description:
2026-02-01 03:38:47 dovecot_login authenticator failed for H=(nsg-static-057.137.71.182.airtel.in) [125.23.183.18]:40684: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:38:04 dovecot_login authenticator failed for H=(swOdB7Tf) [178.16.54.22]:54355: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:38:05 dovecot_login authenticator failed for H=(YJRQ7i) [158.94.208.175]:65431: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2026-02-01 03:38:14 dovecot_login authenticator failed for H=([212.116.247.31]) [212.116.247.31]:49608: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:38:21 dovecot_login authenticator failed for H=(GmhZLba) [158.94.208.175]:50143: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:38:35 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55698: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:38:25 dovecot_login authenticator failed for H=(yQCFCm2U9) [2.58.56.77]:61518: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.163.252.244
country_id: 1814991
description:
2026-02-01 03:38:29 dovecot_login authenticator failed for H=([220.163.252.244]) [220.163.252.244]:53466: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 03:38:40 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:52328: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:39:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:39:14 dovecot_login authenticator failed for H=(ex2dHaWk) [2.58.56.77]:52662: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:39:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:39:11 dovecot_login authenticator failed for H=(3Xn8atXe) [158.94.208.175]:62399: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:39:13 dovecot_login authenticator failed for H=(MS4nSO) [178.16.54.22]:50536: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-01 03:39:14 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:36199: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:39:15 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:64860: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:40:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:40:22 dovecot_login authenticator failed for H=(SfvK4uPGCM) [178.16.54.22]:58364: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:40:43 dovecot_login authenticator failed for H=(KgrnMw9LDn) [158.94.208.175]:58145: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:40:18 dovecot_login authenticator failed for H=(YZLAR5J) [2.58.56.77]:54026: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:40:22 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:53766: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:40:02 dovecot_login authenticator failed for H=(8u2hW3l) [158.94.208.175]:63514: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:40:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51837: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:41:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52322: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:41:17 dovecot_login authenticator failed for H=(7KidFWWE4B) [158.94.208.175]:65017: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:41:58 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62783: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:41:08 dovecot_login authenticator failed for H=(3DhNcp6yGa) [178.16.54.22]:60944: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-02-01 03:42:21 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:35738: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 03:42:22 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:60642: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.244
country_id: 1168579
description:
2026-02-01 03:42:31 dovecot_login authenticator failed for H=(244.92.zcomnetworks.com.pk) [103.148.92.244]:35954: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-02-01 03:42:32 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:54700: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 03:42:36 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:49586: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2026-02-01 03:42:47 dovecot_login authenticator failed for H=([211.178.165.251]) [211.178.165.251]:35608: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:42:07 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64331: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:42:52 dovecot_login authenticator failed for H=(I774mVp1p3) [158.94.208.175]:53219: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:42:21 dovecot_login authenticator failed for H=(onvJBq) [158.94.208.175]:50160: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:42:35 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52930: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:42:17 dovecot_login authenticator failed for H=(N1Px2qTL) [178.16.54.22]:65243: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:43:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:43:07 dovecot_login authenticator failed for H=(ikF1m0) [158.94.208.175]:51433: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:43:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:43:03 dovecot_login authenticator failed for H=(BlUc61wMd) [178.16.54.22]:61463: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-02-01 03:43:48 dovecot_plain authenticator failed for H=(erned) [37.28.177.141]:45139: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:44:18 dovecot_login authenticator failed for H=(znDMCD) [158.94.208.175]:55850: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-02-01 03:44:38 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:64021: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:44:12 dovecot_login authenticator failed for H=(Cbv1gwbE) [178.16.54.22]:65015: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:44:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:44:39 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:59302: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 03:45:00 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:42291: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:44:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:45:16 dovecot_login authenticator failed for H=(lktdO9US) [158.94.208.175]:56409: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:45:21 dovecot_login authenticator failed for H=(feyLdzG) [178.16.54.22]:49409: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:45:02 dovecot_login authenticator failed for H=(lbo7XK8Uq) [158.94.208.175]:61544: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:45:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:45:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.161.143
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=524261 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/introduction-service.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:45:59 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53476: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:46:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:46:07 dovecot_login authenticator failed for H=(jOhxT6dsq) [178.16.54.22]:63976: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:46:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54890: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:46:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:46:19 dovecot_login authenticator failed for H=(AobdH7Ub) [158.94.208.175]:56545: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:46:50 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:57405: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:46:53 dovecot_login authenticator failed for H=(Rx55YqPwk) [2.58.56.77]:64220: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-01 03:46:38 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:40100: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 03:46:59 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:48144: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:47:15 dovecot_login authenticator failed for H=(lTtxU2n6) [158.94.208.175]:59479: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:47:18 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49640: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:47:22 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55597: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:47:37 dovecot_login authenticator failed for H=(MOkCO7XzHf) [158.94.208.175]:65525: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:47:03 dovecot_login authenticator failed for H=(wiSZRvu) [2.58.56.77]:51685: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:47:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:47:16 dovecot_login authenticator failed for H=(3Uw4IZIP) [178.16.54.22]:52536: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:47:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: a-connect.global
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/dpscomsec/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2026-02-01 03:48:57 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:50734: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:48:02 dovecot_login authenticator failed for H=(BRtXuNRJ0t) [178.16.54.22]:52270: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:48:02 dovecot_login authenticator failed for H=(E3KcUrUCS) [2.58.56.77]:62030: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:48:23 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:56185: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:48:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.40
country_id: 6252001
description:
2026-02-01 03:48:19 dovecot_login authenticator failed for H=(ADMIN) [102.129.153.40]:31519: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:48:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51555: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:48:01 dovecot_login authenticator failed for H=(DCZWFyybd) [158.94.208.175]:50988: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:49:08 dovecot_login authenticator failed for H=(YAcZ4to) [2.58.56.77]:59774: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.141
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.212
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:49:32 dovecot_login authenticator failed for H=(wTV9u3s) [158.94.208.175]:51911: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:49:13 dovecot_login authenticator failed for H=(FNTDsyrQI) [158.94.208.175]:59891: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.176.136
country_id: 2139685
description:
2026-02-01 03:49:20 dovecot_login authenticator failed for H=host-202-166-176-136.static.lagoon.nc [202.166.176.136]:40786: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.161
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-02-01 03:49:44 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:38232: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 03:49:53 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:55936: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.151.168
country_id: 6252001
description:
2026-02-01 03:50:00 dovecot_login authenticator failed for H=47-145-151-168.fdr01.blpk.ca.ip.frontiernet.net [47.145.151.168]:52386: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:49:06 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:64157: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.55.145.218
country_id: 1210997
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/news-detail-8.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:49:11 dovecot_login authenticator failed for H=(MP2VSb) [178.16.54.22]:54998: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 03:49:30 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:45126: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 03:49:57 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:48956: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-02-01 03:50:09 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:58128: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:50:13 dovecot_login authenticator failed for H=(xDNzUmWtHa) [2.58.56.77]:50732: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:50:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:50:16 dovecot_login authenticator failed for H=(btoEcterM) [158.94.208.175]:65361: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2026-02-01 03:50:16 dovecot_login authenticator failed for H=([211.196.31.2]) [211.196.31.2]:48795: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:50:20 dovecot_login authenticator failed for H=(PeQdzkn6S) [178.16.54.22]:62428: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:50:09 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52532: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 03:50:14 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:52708: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:51:01 dovecot_login authenticator failed for H=(vJOq82D1y) [158.94.208.175]:62144: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:51:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:51:30 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54849: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 03:51:41 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:15336: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.68.50
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=226839 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:51:54 dovecot_login authenticator failed for H=(1wATb8) [158.94.208.175]:58019: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:51:21 dovecot_login authenticator failed for H=(cSworO) [2.58.56.77]:49312: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.147.118.174
country_id: 2017370
description:
2026-02-01 03:51:02 dovecot_login authenticator failed for H=(174.118.147.82.ekb.enforta.com) [82.147.118.174]:56551: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:51:06 dovecot_login authenticator failed for H=(VjL3yQByMy) [178.16.54.22]:59729: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-02-01 03:51:22 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:42548: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2026-02-01 03:51:30 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:39854: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.39.216.10
country_id: 1814991
description:
2026-02-01 03:51:46 dovecot_login authenticator failed for H=([120.39.216.10]) [120.39.216.10]:50040: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:52:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50785: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 03:52:11 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:57479: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:52:11 dovecot_login authenticator failed for H=(f5OrWPV0) [158.94.208.175]:63008: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:52:49 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58825: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:52:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:52:05 dovecot_login authenticator failed for H=(cFLZekpqVe) [2.58.56.77]:53397: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:52:15 dovecot_login authenticator failed for H=(S0W5R0UJK) [178.16.54.22]:61598: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:53:01 dovecot_login authenticator failed for H=(YBGCHR) [178.16.54.22]:65505: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:53:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54810: 535 Incorrect authentication data (set_id=testing@box.wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:53:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:53:10 dovecot_login authenticator failed for H=(VPUxbo) [2.58.56.77]:49646: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:53:13 dovecot_login authenticator failed for H=(KGFzUIw) [158.94.208.175]:50260: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:53:22 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:62414: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:53:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 03:53:30 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:48252: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 03:53:43 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:36278: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:54:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56148: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:54:07 dovecot_login authenticator failed for H=(BEGRFVr) [158.94.208.175]:54818: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:54:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 4.246.227.87
country_id: 6252001
description:
Feb  1 03:54:26 sv3 pure-ftpd[523166]: (?@4.246.227.87) [WARNING] Authentication failed for user [+60146294496]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.143.81
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:54:57 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63359: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:54:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:54:10 dovecot_login authenticator failed for H=(uu5yMjrD) [178.16.54.22]:52208: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:54:16 dovecot_login authenticator failed for H=(mZjKrB3x) [2.58.56.77]:51469: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-02-01 03:54:56 dovecot_login authenticator failed for H=([179.181.135.1]) [179.181.133.153]:43291: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:55:19 dovecot_login authenticator failed for H=(7zUyVsE1Z) [178.16.54.22]:63943: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-02-01 03:55:36 dovecot_login authenticator failed for H=(nsg-corporate-80.229.187.122.airtel.in) [122.187.229.80]:38190: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 03:55:47 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:15521: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 03:55:07 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57825: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:55:12 dovecot_login authenticator failed for H=(Gq2DIU0M0) [158.94.208.175]:59855: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:55:52 dovecot_login authenticator failed for H=(rcCXZ809w) [158.94.208.175]:54084: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 03:55:53 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59885: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:55:03 dovecot_login authenticator failed for H=(HdJPKgCcE) [2.58.56.77]:58914: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:55:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-02-01 03:56:34 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:33384: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.105.66
country_id: 1814991
description:
2026-02-01 03:56:25 dovecot_login authenticator failed for H=([61.160.105.66]) [61.160.105.66]:57869: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:56:06 dovecot_login authenticator failed for H=(N42eJKxc) [178.16.54.22]:62902: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-02-01 03:56:28 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:48262: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:56:57 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:60179: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 201.81.52.82
country_id: 3469034
domain: nexuscollection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:18724.nexuscollection.com||ServerName:nexuscollection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:19e7685f5527b7b7de257ef2ecf6f419c4b8294f||Title:0xfebcc358||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:56:13 dovecot_login authenticator failed for H=(qd2Mf4JBQ) [158.94.208.175]:62148: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.98
country_id: 1269750
description:
2026-02-01 03:56:30 dovecot_login authenticator failed for H=([182.78.70.98]) [182.78.70.98]:48646: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:56:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 03:56:08 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:34704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-02-01 03:56:12 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com [95.155.228.189]:35397: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:56:13 dovecot_login authenticator failed for H=(vUu6Sv) [2.58.56.77]:52302: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 03:56:46 dovecot_login authenticator failed for H=(7sWqR5lVc) [158.94.208.110]:56192: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-02-01 03:56:52 dovecot_login authenticator failed for H=([1.250.67.114]) [1.250.67.114]:58248: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-01 03:57:19 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:59660: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 03:57:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:57:30 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52965: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:58:01 dovecot_login authenticator failed for H=(n3kQFkwd8J) [158.94.208.175]:61940: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:57:12 dovecot_login authenticator failed for H=(a4KpqE9yn) [158.94.208.175]:63165: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:57:16 dovecot_login authenticator failed for H=(Hks4eATza) [2.58.56.77]:58636: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.17.75.98
country_id: 6252001
description:
2026-02-01 03:57:22 dovecot_login authenticator failed for H=([127.0.0.1]) [184.17.75.98]:46582: 535 Incorrect authentication data (set_id=info@prominentaccess.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 03:57:10 dovecot_login authenticator failed for H=(E9oW001XPC) [158.94.208.110]:55389: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:57:15 dovecot_login authenticator failed for H=(p00qa8ihd6) [178.16.54.22]:57040: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.181.142
country_id: 953987
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/news-detail8.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 03:57:48 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:37386: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:58:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 03:58:44 dovecot_login authenticator failed for H=(mE4hek) [158.94.208.110]:53602: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:58:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-02-01 03:59:00 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:51854: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:58:06 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52178: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:58:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65444: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:58:06 dovecot_login authenticator failed for H=(tPfWvoR) [2.58.56.77]:55887: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:58:07 dovecot_login authenticator failed for H=(hWeW1C) [158.94.208.175]:61274: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:58:24 dovecot_login authenticator failed for H=(TUEi0M) [178.16.54.22]:60615: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-01 03:58:37 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:47190: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 03:59:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 03:59:32 dovecot_login authenticator failed for H=(eAqf3h) [178.16.54.22]:63440: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 03:59:08 dovecot_login authenticator failed for H=(HdRYN4HX) [158.94.208.110]:57363: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 03:59:11 dovecot_login authenticator failed for H=(UYMcqOV) [2.58.56.77]:57762: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
country_id: 1814991
description:
2026-02-01 03:59:35 dovecot_login authenticator failed for H=(Mail.chinaqiaoyu.com) [222.185.255.227]:38461: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.31.119
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 03:59:06 dovecot_login authenticator failed for H=(5tIAjC) [158.94.208.175]:63222: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 03:59:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 03:59:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60908: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 03:59:12 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:34862: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 03:59:24 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:62272: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:00:30 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:50610: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:00:18 dovecot_login authenticator failed for H=(4f47xVp) [178.16.54.22]:50359: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 04:00:42 dovecot_login authenticator failed for H=(mLYoI1Eh) [158.94.208.110]:49807: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 04:00:14 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:51800: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:00:24 dovecot_login authenticator failed for H=(Q1ERbT) [2.58.56.77]:53500: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:00:10 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53806: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:00:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:00:21 dovecot_login authenticator failed for H=(qkaUvPb) [158.94.208.175]:59084: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:00:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-02-01 04:00:49 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:47952: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:00:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57945: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 04:00:50 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:52902: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:01:02 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:53634: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:01:04 dovecot_login authenticator failed for H=(4z5KLU2) [178.16.54.22]:61542: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:01:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:01:07 dovecot_login authenticator failed for H=(yFXVhSRP) [2.58.56.77]:58280: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-02-01 04:01:16 dovecot_plain authenticator failed for H=(othip) [50.187.152.61]:60140: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.204
country_id: 1835841
description:
2026-02-01 04:01:25 dovecot_login authenticator failed for H=([211.198.128.204]) [211.198.128.204]:49955: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:01:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 04:01:06 dovecot_login authenticator failed for H=(RQsUZo5) [158.94.208.110]:53095: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:01:09 dovecot_login authenticator failed for H=(1LB4UTpn) [158.94.208.175]:58932: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-02-01 04:01:46 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:53620: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:02:11 dovecot_login authenticator failed for H=(zlh4wNhx) [158.94.208.175]:58470: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:02:13 dovecot_login authenticator failed for H=(OpYvJWA) [178.16.54.22]:59484: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:02:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:02:17 dovecot_login authenticator failed for H=(h5VDdFkoV) [2.58.56.77]:51772: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 04:02:23 dovecot_login authenticator failed for H=(sWtzexrlTP) [69.5.189.21]:63965: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:02:36 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49431: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-01 04:03:41 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:59900: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 04:03:10 dovecot_login authenticator failed for H=(9ihAC7) [69.5.189.21]:55176: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-02-01 04:03:31 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net [110.25.112.132]:32956: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:03:22 dovecot_login authenticator failed for H=(wgBBMkPNcD) [178.16.54.22]:53804: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:03:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:03:30 dovecot_login authenticator failed for H=(aOUdp9) [158.94.208.175]:60016: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-02-01 04:03:52 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:42390: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:03:03 dovecot_login authenticator failed for H=(Q41wbyz) [2.58.56.77]:62024: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 04:03:07 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:37642: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:03:07 dovecot_login authenticator failed for H=(sG3Oe3A) [158.94.208.175]:60719: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:03:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2026-02-01 04:04:02 dovecot_login authenticator failed for H=([182.95.224.62]) [182.95.224.62]:34792: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:04:14 dovecot_login authenticator failed for H=(7ZR67NmvA) [2.58.56.77]:60854: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:04:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49961: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-02-01 04:04:55 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:57711: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 04:04:20 dovecot_login authenticator failed for H=(pE0EIhD) [69.5.189.21]:50012: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:04:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:04:06 dovecot_login authenticator failed for H=(FUYGApqh) [158.94.208.175]:55223: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:04:08 dovecot_login authenticator failed for H=(JoUsWvnL) [178.16.54.22]:62616: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 04:05:08 dovecot_login authenticator failed for H=(JWFcUPpT) [69.5.189.21]:58173: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:05:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:05:17 dovecot_login authenticator failed for H=(3Fvz9WogYG) [178.16.54.22]:57420: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-02-01 04:05:57 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:62616: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:05:09 dovecot_login authenticator failed for H=(jAvpj9) [158.94.208.175]:65502: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:05:20 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:54939: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:05:26 dovecot_login authenticator failed for H=(odaNb8) [2.58.56.77]:58014: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:05:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64880: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 04:05:05 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:57040: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:06:04 dovecot_login authenticator failed for H=(bQx1Zt) [178.16.54.22]:56999: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:06:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51044: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:06:11 dovecot_login authenticator failed for H=(K8Hn10j) [2.58.56.77]:52063: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 04:06:17 dovecot_login authenticator failed for H=(aY9iuDFL0t) [69.5.189.21]:53025: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:07:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61367: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:06:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:06:03 dovecot_login authenticator failed for H=(duXnkFQMUc) [158.94.208.175]:58176: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 158.173.154.110
country_id: 2921044
domain: masaakisb.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 158.173.154.110
country_id: 2921044
domain: masaakisb.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:06:57 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:64833: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 04:06:13 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:46063: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-02-01 04:06:36 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:39860: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-02-01 04:06:55 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:47534: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 04:07:04 dovecot_login authenticator failed for H=(ldTJIdfu) [69.5.189.21]:60681: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:07:13 dovecot_login authenticator failed for H=(oryJrIE3Z) [178.16.54.22]:54647: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2026-02-01 04:07:24 dovecot_login authenticator failed for H=([27.24.141.119]) [27.24.141.119]:37876: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:07:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:07:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:07:13 dovecot_login authenticator failed for H=(8CYR0UbEqm) [2.58.56.77]:56366: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:07:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52063: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:07:15 dovecot_login authenticator failed for H=(Q95y2WF) [158.94.208.175]:62521: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.217.174
country_id: 3469034
domain: www.aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aire-fresh.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:07:28 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:62206: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:08:20 dovecot_login authenticator failed for H=(CPcwHyT3) [2.58.56.77]:51377: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.77
country_id: 1814991
description:
2026-02-01 04:08:02 dovecot_login authenticator failed for H=([111.26.100.77]) [111.26.100.77]:44774: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:08:33 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:58209: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 04:08:53 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:46338: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:08:04 dovecot_login authenticator failed for H=(gJXFoVz) [158.94.208.175]:61679: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:08:22 dovecot_login authenticator failed for H=(mWCovHB1a) [178.16.54.22]:53664: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 04:08:53 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:42136: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:08:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-01 04:08:10 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:50446: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:08:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-02-01 04:08:21 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:52720: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 04:08:36 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:37156: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-02-01 04:08:41 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:39446: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 04:08:42 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:54330: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:09:08 dovecot_login authenticator failed for H=(207DpoQw) [178.16.54.22]:49429: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:09:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:09:49 dovecot_login authenticator failed for H=(AzutnF) [158.94.208.175]:50830: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:09:06 dovecot_login authenticator failed for H=(zk12VAdjXc) [2.58.56.77]:56580: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:09:14 dovecot_login authenticator failed for H=(HuLSHyi) [158.94.208.175]:62734: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 04:09:25 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:51330: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.50.4.33
country_id: 290557
domain: nobledec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69720.nobledec.com||ServerName:nobledec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e00caf0ada35173780d44f73583f109695e8456||Title:0x9a22375f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:09:11 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:58200: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.113.242.18
country_id: 3469034
domain: nmahir.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:21537.nmahir.com||ServerName:nmahir.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f5ad9cdf6ba010fab9e3096950de610722901a59||Title:0x30e256d6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:10:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:10:13 dovecot_login authenticator failed for H=(sQDALj) [158.94.208.175]:49923: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 04:10:47 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:41574: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:10:12 dovecot_login authenticator failed for H=(JyESed9vi0) [2.58.56.77]:64539: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:10:16 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52772: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:10:17 dovecot_login authenticator failed for H=(Frnc11VgIH) [178.16.54.22]:56952: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:11:03 dovecot_login authenticator failed for H=(tBMiC50X) [178.16.54.22]:56349: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:11:04 dovecot_login authenticator failed for H=(uoPWIr9M0) [158.94.208.175]:49260: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.130.22
country_id: 1814991
description:
2026-02-01 04:11:28 dovecot_login authenticator failed for H=([58.58.130.22]) [58.58.130.22]:47538: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:11:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:11:18 dovecot_login authenticator failed for H=(HSZ5y8) [2.58.56.77]:57155: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:11:19 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60457: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:11:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57547: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 04:11:03 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:57064: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-02-01 04:11:59 dovecot_login authenticator failed for H=([182.78.255.201]) [125.20.245.182]:38520: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.216.195.185
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95608.nobledec.com||ServerName:nobledec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e02378c11da4053239aa5af01d3e0fa763937b3||Title:0x0ac78b14||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:12:14 dovecot_login authenticator failed for H=(psJ8yZ67) [158.94.208.175]:49421: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 04:12:09 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:57716: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:12:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:12:12 dovecot_login authenticator failed for H=(EOrXbLSDo) [178.16.54.22]:58990: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.181.7
country_id: 1814991
description:
2026-02-01 04:12:48 dovecot_login authenticator failed for H=([61.145.181.7]) [61.145.181.7]:47337: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:12:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:12:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 04:12:20 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59317: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-02-01 04:12:30 dovecot_login authenticator failed for H=([27.123.119.254]) [128.185.246.106]:54714: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
country_id: 1814991
description:
2026-02-01 04:12:55 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.196.162]:15444: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:12:03 dovecot_login authenticator failed for H=(sPsmAwn5vk) [2.58.56.77]:57051: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:12:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60487: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.187.65.135
country_id: 1814991
description:
2026-02-01 04:13:07 dovecot_login authenticator failed for H=([118.187.65.135]) [118.187.65.135]:52724: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:13:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.102.154
country_id: 1269750
description:
2026-02-01 04:13:46 dovecot_login authenticator failed for H=(static-154.102.107.27-tataidc.co.in) [27.107.102.154]:42124: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:13:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:13:10 dovecot_login authenticator failed for H=(uQaSad) [2.58.56.77]:55310: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.59.158
country_id: 2017370
description:
2026-02-01 04:13:22 dovecot_login authenticator failed for H=([188.247.59.158]) [188.247.59.158]:51060: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:13:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 04:13:34 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:13:02 dovecot_login authenticator failed for H=(uHN25vYEq4) [158.94.208.175]:63913: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:13:21 dovecot_login authenticator failed for H=(lWwGr4ft) [178.16.54.22]:52805: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: tst-ma.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home/tstmacom/public_html/images/sendto.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 04:13:49 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:35620: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:13:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56701: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 04:13:23 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:50990: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:14:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:14:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:14:12 dovecot_login authenticator failed for H=(ODCqLRk) [158.94.208.175]:65407: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:14:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:14:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56294: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:14:19 dovecot_login authenticator failed for H=(5bsAFbq4F) [2.58.56.77]:56951: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:14:07 dovecot_login authenticator failed for H=(yxfnbHhr3) [178.16.54.22]:60793: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.167.166
country_id: 1814991
description:
2026-02-01 04:15:51 dovecot_login authenticator failed for H=([111.26.167.166]) [111.26.167.166]:40178: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:15:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2026-02-01 04:15:51 dovecot_login authenticator failed for H=([128.185.223.219]) [27.123.111.114]:44226: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:15:03 dovecot_login authenticator failed for H=(3v6uBDGc) [158.94.208.175]:53385: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:15:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57881: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:15:22 dovecot_login authenticator failed for H=(jWCKJiRvRh) [2.58.56.77]:52883: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.237.78.41
country_id: 3469034
description:
2026-02-01 04:15:39 dovecot_login authenticator failed for H=([45.237.78.41]) [45.237.78.41]:36144: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:15:16 dovecot_login authenticator failed for H=(uBvUIBCiA) [178.16.54.22]:64077: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:15:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01  4:16:52 200536 [Warning] Aborted connection 200536 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:16:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:16:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:16:11 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64758: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:16:16 dovecot_login authenticator failed for H=(SD4LTiW) [158.94.208.175]:56222: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.67.85
country_id: 2017370
description:
2026-02-01 04:16:01 dovecot_login authenticator failed for H=([87.251.67.85]) [87.251.67.85]:51098: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:16:02 dovecot_login authenticator failed for H=(g2KTc2bz) [178.16.54.22]:49256: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:16:09 dovecot_login authenticator failed for H=(53bnhol0j) [2.58.56.77]:54162: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:17:02 dovecot_login authenticator failed for H=(bEa49mN4) [158.94.208.175]:60770: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:17:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:17:11 dovecot_login authenticator failed for H=(9wpOiN) [178.16.54.22]:56368: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:17:12 dovecot_login authenticator failed for H=(4GnwGDF) [2.58.56.77]:52201: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.0.40
country_id: 1668284
description:
2026-02-01 04:19:00 dovecot_login authenticator failed for H=([101.13.0.40]) [101.13.0.40]:50350: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-02-01 04:18:07 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:53925: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:18:11 dovecot_login authenticator failed for H=(trI9Hj) [158.94.208.175]:63328: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:18:20 dovecot_login authenticator failed for H=(eUWHNVpc2) [178.16.54.22]:62427: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:18:21 dovecot_login authenticator failed for H=(1GB7RyTkw) [2.58.56.77]:54949: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.147.65
country_id: 895949
description:
2026-02-01 04:18:28 dovecot_plain authenticator failed for H=(chylly) [41.60.147.65]:56375: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 04:18:44 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:53256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2026-02-01 04:18:50 dovecot_login authenticator failed for H=([113.219.177.95]) [113.219.177.95]:44950: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:19:29 dovecot_login authenticator failed for H=(9gd032Dzrd) [2.58.56.77]:49909: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:19:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 04:19:53 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:18279: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:19:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61949: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:19:06 dovecot_login authenticator failed for H=(n74jRGjTyd) [178.16.54.22]:56503: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:19:06 dovecot_login authenticator failed for H=(DQHypzB) [2.58.56.77]:64706: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:19:22 dovecot_login authenticator failed for H=(HSZ8UF) [158.94.208.175]:56137: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:20:15 dovecot_login authenticator failed for H=(wNL43y) [178.16.54.22]:56830: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:20:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50314: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 04:20:03 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:33470: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:20:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:20:08 dovecot_login authenticator failed for H=(jrQuzLUdd0) [158.94.208.175]:64041: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:20:14 dovecot_login authenticator failed for H=(qPI3yTvm) [2.58.56.77]:64204: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:21:02 dovecot_login authenticator failed for H=(5wCkmXmwC) [158.94.208.175]:61447: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:21:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61362: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:21:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:21:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61513: 535 Incorrect authentication data (set_id=testing@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:21:01 dovecot_login authenticator failed for H=(yqLrMG3) [178.16.54.22]:64506: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:21:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:21:01 dovecot_login authenticator failed for H=(007xHxlll) [2.58.56.77]:62779: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:22:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:22:11 dovecot_login authenticator failed for H=(bn1axo3Y) [2.58.56.77]:54481: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:22:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:22:50 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65204: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:22:10 dovecot_login authenticator failed for H=(7wb3WGy) [178.16.54.22]:56011: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.174.255.242
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28831514526532 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.112
country_id: 2635167
description:
2026-02-01 04:22:12 dovecot_plain authenticator failed for H=([10.25.18.10]) [158.173.23.112]:9250: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:22:14 dovecot_login authenticator failed for H=(AWxpPS6wH1) [158.94.208.175]:61687: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:22:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58612: 535 Incorrect authentication data (set_id=testing@wcc.wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:22:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:23:19 dovecot_login authenticator failed for H=(jGCBioIa) [178.16.54.22]:53262: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:23:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:23:21 dovecot_login authenticator failed for H=(C4lJZr) [2.58.56.77]:54417: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.7
country_id: 6252001
description:
2026-02-01 04:23:31 dovecot_login authenticator failed for H=(ADMIN) [37.19.221.7]:47341: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:23:04 dovecot_login authenticator failed for H=(MyQl6l7V) [158.94.208.175]:49379: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:23:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:23:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:24:06 dovecot_login authenticator failed for H=(DxaaaXB) [2.58.56.77]:52950: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:24:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:24:13 dovecot_login authenticator failed for H=(77Kswl4) [158.94.208.175]:56797: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:24:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:24:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:24:05 dovecot_login authenticator failed for H=(roh285C) [178.16.54.22]:55582: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 04:24:09 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:45334: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:24:40 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52169: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:25:10 dovecot_login authenticator failed for H=(q3WnqjKxcT) [2.58.56.77]:50108: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:25:28 dovecot_login authenticator failed for H=(pCx46jTZk7) [158.94.208.175]:53342: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.14.172
country_id: 6252001
description:
[2026-02-01 04:25:11 +0800] info [webmaild] 65.111.14.172 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:25:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:25:14 dovecot_login authenticator failed for H=(n9FdDjZh) [178.16.54.22]:58672: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 04:25:12 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:33042: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:25:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64546: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-02-01 04:25:48 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:58939: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2026-02-01 04:26:46 dovecot_login authenticator failed for H=(2-55-88-152.orange.net.il) [2.55.88.152]:60096: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:26:22 dovecot_login authenticator failed for H=(MIuF2Tm13C) [2.58.56.77]:63641: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:26:23 dovecot_login authenticator failed for H=(Szdcoev9H) [178.16.54.22]:60516: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:26:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:26:17 dovecot_login authenticator failed for H=(mkD367Ie) [158.94.208.175]:65049: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2026-02-01 04:26:07 dovecot_login authenticator failed for H=(static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:58978: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.149.79.127
country_id: 6252001
description:
2026-02-01 04:27:22 dovecot_login authenticator failed for H=([24.149.79.127]) [24.149.79.127]:55432: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:27:03 dovecot_login authenticator failed for H=(h0yqk4u) [158.94.208.175]:56045: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:27:04 dovecot_login authenticator failed for H=(JinksY) [2.58.56.77]:55942: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:27:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2026-02-01 04:27:08 dovecot_login authenticator failed for H=(static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:42645: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:27:09 dovecot_login authenticator failed for H=(wfHbRdB6P) [178.16.54.22]:55323: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-02-01 04:27:16 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:53414: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-01 04:27:20 dovecot_plain authenticator failed for H=(quals) [102.53.15.180]:34699: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.214.18
country_id: 1814991
description:
2026-02-01 04:27:30 dovecot_login authenticator failed for H=([218.13.214.18]) [218.13.214.18]:43890: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-02-01 04:27:31 dovecot_login authenticator failed for H=([42.1.110.201]) [42.1.110.201]:60488: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-02-01 04:27:49 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:43307: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:27:52 dovecot_login authenticator failed for H=(MXI3wg) [2.58.56.77]:56630: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:28:19 dovecot_login authenticator failed for H=(LEdTxYM) [2.58.56.77]:62603: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-02-01 04:28:11 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:45242: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 04:28:39 dovecot_plain authenticator failed for H=(intive) [64.72.74.162]:51437: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:28:40 dovecot_login authenticator failed for H=(FOnWEvD59) [158.94.208.175]:65336: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 04:28:51 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:56608: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:28:18 dovecot_login authenticator failed for H=(Vp4fg0s) [178.16.54.22]:49863: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:28:35 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50527: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:29:04 dovecot_login authenticator failed for H=(0thjIt6oD) [158.94.208.175]:56530: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 04:29:37 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:54046: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:29:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:29:54 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62917: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:29:04 dovecot_login authenticator failed for H=(Twspv3dCnm) [178.16.54.22]:49653: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:29:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51430: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 04:29:25 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:39652: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-02-01 04:29:45 dovecot_login authenticator failed for H=([61.97.17.208]) [61.97.17.208]:53000: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:29:22 dovecot_login authenticator failed for H=(2VhmLLsZ) [2.58.56.77]:54593: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:30:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51440: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:30:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:30:17 dovecot_login authenticator failed for H=(8qbQMK) [158.94.208.175]:52086: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:30:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55958: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:30:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:30:10 dovecot_login authenticator failed for H=(d0QnaF) [2.58.56.77]:60982: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:30:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51761: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 04:30:13 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:37754: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:30:13 dovecot_login authenticator failed for H=(kMfcTmn) [178.16.54.22]:49915: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:31:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 04:31:20 dovecot_login authenticator failed for H=(wga4UIg) [2.58.56.77]:62156: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:31:05 dovecot_login authenticator failed for H=(wgTBx2E) [158.94.208.175]:54187: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 04:31:15 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36626: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 04:31:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:31:22 dovecot_login authenticator failed for H=(62soSI5gD) [178.16.54.22]:49292: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:31:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 04:31:27 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:60498: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:31:34 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58776: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:32:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:32:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:32:08 dovecot_login authenticator failed for H=(IExYBGZl) [178.16.54.22]:54972: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-02-01 04:32:16 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [116.72.9.151]:37808: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
country_id: 2017370
description:
2026-02-01 04:32:19 dovecot_login authenticator failed for H=(est.giport.ru) [82.208.65.46]:3112: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 04:32:21 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:58860: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.155.146
country_id: 1814991
description:
2026-02-01 04:32:25 dovecot_login authenticator failed for H=([58.56.155.146]) [58.56.155.146]:42430: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:32:20 dovecot_login authenticator failed for H=(eatBJF0A9A) [158.94.208.175]:65080: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2026-02-01 04:32:33 dovecot_login authenticator failed for H=([183.6.43.236]) [183.6.43.236]:45812: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-02-01 04:32:45 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:45258: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:33:07 dovecot_login authenticator failed for H=(FdBipl) [158.94.208.175]:62540: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:33:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:33:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:33:17 dovecot_login authenticator failed for H=(uqD0UN) [178.16.54.22]:51475: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:33:25 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58260: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:34:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-02-01 04:34:24 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:47914: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:34:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:34:23 dovecot_login authenticator failed for H=(jKqr6u) [158.94.208.175]:54384: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2026-02-01 04:34:39 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:41376: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:34:03 dovecot_login authenticator failed for H=(xSolxAU) [178.16.54.22]:52686: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2026-02-01 04:34:15 dovecot_login authenticator failed for H=([58.22.255.28]) [58.22.255.28]:33671: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2026-02-01 04:34:47 dovecot_login authenticator failed for H=s-21-102-63-202.southernonline.net [202.63.102.21]:52615: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-01 04:35:48 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:52100: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-02-01 04:35:58 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:55692: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:35:12 dovecot_login authenticator failed for H=(dqsYWVy) [178.16.54.22]:62432: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.59
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 04:35:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:35:10 dovecot_login authenticator failed for H=(sW4Ly5) [158.94.208.175]:49284: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:36:44 dovecot_login authenticator failed for H=(NLSRpKF7) [178.16.54.22]:55173: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-02-01 04:36:51 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:38015: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:36:19 dovecot_login authenticator failed for H=(GLna1V) [158.94.208.175]:64193: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:36:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51901: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:36:21 dovecot_login authenticator failed for H=(aVJNa0) [178.16.54.22]:60270: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:37:07 dovecot_login authenticator failed for H=(Lnf26QsE56) [178.16.54.22]:59782: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 04:37:25 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:60562: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 04:37:32 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:32883: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.52.32.148
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=947582 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:37:06 dovecot_login authenticator failed for H=(Uvoe0GK) [158.94.208.175]:51205: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:37:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57849: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:38:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49846: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: urban.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home/urban/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-02-01 04:37:03 dovecot_login authenticator failed for H=([218.156.2.230]) [218.156.2.229]:59539: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2026-02-01 04:37:08 dovecot_login authenticator failed for H=105.217.146.34.bc.googleusercontent.com [34.146.217.105]:53054: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 04:37:22 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:47882: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:38:41 dovecot_login authenticator failed for H=(CsQRmqK) [158.94.208.175]:52941: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:38:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60597: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-01 04:38:33 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:29914: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:38:18 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63751: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: urban.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/urban/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-01 04:38:56 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:48188: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2026-02-01 04:39:24 dovecot_login authenticator failed for H=([124.65.160.234]) [124.65.160.234]:43014: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:39:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-02-01 04:39:35 dovecot_login authenticator failed for H=([182.95.176.206]) [182.95.176.206]:49756: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:39:55 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57561: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:39:05 dovecot_login authenticator failed for H=(0mi9GU) [158.94.208.175]:61567: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:40:17 dovecot_login authenticator failed for H=(QNAYzs) [158.94.208.175]:59920: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2026-02-01 04:40:07 dovecot_login authenticator failed for H=([118.26.153.84]) [118.26.153.84]:61810: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:40:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 04:40:26 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:54937: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:40:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58545: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 04:40:13 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:48670: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-02-01 04:40:19 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:52344: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2026-02-01 04:40:27 dovecot_login authenticator failed for H=ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:42534: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-01 04:41:57 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:48231: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:41:06 dovecot_login authenticator failed for H=(2QSSi2HXl) [158.94.208.175]:52629: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.41.61
country_id: 1168579
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1900553621.jpg&size=1000x1000 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:41:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:41:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54015: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:41:57 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58143: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2026-02-01 04:42:12 dovecot_login authenticator failed for H=([27.223.98.117]) [27.223.98.117]:36533: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-02-01 04:42:22 dovecot_login authenticator failed for H=a4.ucndns.in [103.252.168.4]:60738: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 04:42:29 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:24712: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-02-01 04:42:30 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:52088: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 04:42:51 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:39160: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:42:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.221.182
country_id: 1210997
description:
2026-02-01 04:42:35 dovecot_login authenticator failed for H=([103.178.221.180]) [103.178.221.182]:42171: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-02-01 04:42:56 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:51918: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:42:15 dovecot_login authenticator failed for H=(K6zToKMJ4v) [158.94.208.175]:58997: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:43:29 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54670: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:43:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:43:02 dovecot_login authenticator failed for H=(b3OrgE) [158.94.208.175]:51867: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-02-01 04:43:32 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:49324: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-02-01 04:43:08 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:38004: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.86
country_id: 1269750
description:
2026-02-01 04:43:40 dovecot_login authenticator failed for H=([125.23.237.86]) [125.23.237.86]:60466: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.157
country_id: 6252001
description:
2026-02-01 04:44:12 dovecot_plain authenticator failed for H=([10.28.18.131]) [140.228.24.157]:11151: 535 Incorrect authentication data (set_id=tw.lee@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:44:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50424: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:44:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62466: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:44:13 dovecot_login authenticator failed for H=(Z9L0jungGD) [158.94.208.175]:57616: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:45:01 dovecot_login authenticator failed for H=(lm5Pg1nR) [158.94.208.175]:57696: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:45:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59041: 535 Incorrect authentication data (set_id=test@box.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-02-01 04:45:42 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:58944: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:46:00 dovecot_login authenticator failed for H=(NdvZxlvd) [45.94.31.131]:54570: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 04:46:45 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:26532: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.99.5.31
country_id: 2017370
description:
2026-02-01 04:46:49 dovecot_login authenticator failed for H=([176.99.5.31]) [176.99.5.31]:46312: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:46:13 dovecot_login authenticator failed for H=(L27uYLOGOk) [158.94.208.175]:58092: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:46:10 dovecot_login authenticator failed for H=(hccbXJH) [45.94.31.131]:53946: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:46:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55773: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.150.168.226
country_id: 1814991
description:
2026-02-01 04:46:04 dovecot_login authenticator failed for H=([27.150.168.226]) [27.150.168.226]:60148: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-02-01 04:46:43 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:50897: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 04:46:18 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:54912: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:47:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55041: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:47:06 dovecot_login authenticator failed for H=(1WmdCk7Wx6) [45.94.31.131]:50763: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 04:47:09 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:39630: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 04:47:16 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:39065: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 04:47:19 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:47872: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:47:25 dovecot_login authenticator failed for H=(Lkkmt5sxXw) [158.94.208.175]:56854: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:48:09 dovecot_login authenticator failed for H=(WpmqlJjO) [158.94.208.175]:53582: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:48:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-02-01 04:48:31 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (torpers) [73.230.86.50]:46662: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:48:10 dovecot_login authenticator failed for H=(euVigqquB) [45.94.31.131]:60692: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:48:52 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58304: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-02-01 04:49:25 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (tivvism) [174.166.153.20]:36992: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-02-01 04:49:05 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:50110: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:49:11 dovecot_login authenticator failed for H=(dJZEdQ) [45.94.31.131]:54690: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-02-01 04:49:17 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:34444: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:49:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:49:19 dovecot_login authenticator failed for H=(3qkInI6iI8) [158.94.208.175]:49845: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:49:15 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51068: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.205.50
country_id: 690791
description:
2026-02-01 04:49:17 dovecot_plain authenticator failed for H=(rocrolde) [83.143.205.50]:48961: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:49:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.21.151.21
country_id: 2802361
description:
2026-02-01 04:49:21 dovecot_plain authenticator failed for H=78-21-151-21.access.telenet.be (nocoys) [78.21.151.21]:53310: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 04:50:37 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:48370: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:50:14 dovecot_login authenticator failed for H=(2ZhqDacEv) [45.94.31.131]:61497: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:50:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 04:50:06 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:54604: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:50:40 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55177: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 04:50:47 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:48426: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:50:03 dovecot_login authenticator failed for H=(lUCRSz37hW) [158.94.208.175]:62323: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 04:50:06 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:51130: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:50:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:51:54 dovecot_login authenticator failed for H=(D7s6mhr) [45.94.31.131]:63717: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:51:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:51:14 dovecot_login authenticator failed for H=(FLsgIEC) [158.94.208.175]:59291: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:51:14 dovecot_login authenticator failed for H=(XBLCUGBvW) [45.94.31.131]:55918: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:51:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.148.140.150
country_id: 6252001
description:
[2026-02-01 04:51:32 +0800] info [webmaild] 217.148.140.150 - eeyh@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:52:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 04:52:49 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:33630: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 04:52:55 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:50928: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:52:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53445: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:52:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63673: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:52:23 dovecot_login authenticator failed for H=(lYM4fRk) [158.94.208.175]:50072: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:52:14 dovecot_login authenticator failed for H=(5FH4NF) [45.94.31.131]:49835: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:52:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:53:10 dovecot_login authenticator failed for H=(mGQOez7Eik) [158.94.208.175]:55917: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:53:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.189
country_id: 6252001
description:
2026-02-01 04:53:20 dovecot_plain authenticator failed for H=([10.30.18.113]) [140.228.24.189]:7017: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 04:53:37 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:10786: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 04:53:07 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46472: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.177.212
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=17 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:53:16 dovecot_login authenticator failed for H=(GhxQVZ5ts) [45.94.31.131]:59915: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-02-01 04:53:19 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:51508: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:53:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56556: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 04:53:11 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:54143: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2026-02-01 04:54:09 dovecot_login authenticator failed for H=(170-83-41-60.swtelecom.com.br) [170.83.41.60]:53872: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:54:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56194: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:54:16 dovecot_login authenticator failed for H=(GzWFyyVBSn) [45.94.31.131]:63069: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:54:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58780: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.189
country_id: 6252001
description:
2026-02-01 04:54:01 dovecot_plain authenticator failed for H=([10.30.18.113]) [140.228.24.189]:3681: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2026-02-01 04:54:17 dovecot_login authenticator failed for H=([222.128.15.127]) [222.128.15.127]:39112: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:54:21 dovecot_login authenticator failed for H=(ytY6W8pOE) [158.94.208.175]:61196: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:55:17 dovecot_login authenticator failed for H=(6s5d88) [45.94.31.131]:54147: 535 Incorrect authentication data (set_id=astpkg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/asia/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-02-01 04:55:04 dovecot_plain authenticator failed for H=(bulutte) [5.32.107.6]:44670: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:55:08 dovecot_login authenticator failed for H=(n28iSBwQ) [158.94.208.175]:51572: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2026-02-01 04:56:48 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:39032: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-02-01 04:56:56 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:55712: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:56:18 dovecot_login authenticator failed for H=(4E1GWXf) [158.94.208.175]:50813: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.232.215.160
country_id: 3469034
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.113.138
country_id: 1814991
description:
2026-02-01 04:56:19 dovecot_login authenticator failed for H=([27.115.113.138]) [27.115.113.138]:59138: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:56:34 dovecot_login authenticator failed for H=(LupbjSW) [84.239.7.19]:30708: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-02-01 04:56:44 dovecot_login authenticator failed for H=(static.94.254.104.190.cps.com.ar) [190.104.254.91]:57705: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-02-01 04:56:56 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:38626: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:56:17 dovecot_login authenticator failed for H=(S6VasbSqh8) [45.94.31.131]:50544: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:57:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:57:25 dovecot_login authenticator failed for H=(TuyFZp3) [178.16.54.22]:61839: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:57:27 dovecot_login authenticator failed for H=(cnQfA1) [84.239.7.19]:48283: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:57:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:57:04 dovecot_login authenticator failed for H=(eYLWQdY2Mm) [158.94.208.175]:49647: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-01 04:57:22 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:24544: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:57:16 dovecot_login authenticator failed for H=(vdfzWK4nmB) [45.94.31.131]:58095: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 04:58:46 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:48548: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:59:01 dovecot_login authenticator failed for H=(AcVzOwuw) [45.94.31.131]:55202: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:58:13 dovecot_login authenticator failed for H=(IBHI4Qu5) [158.94.208.175]:64585: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 04:58:25 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:60678: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 04:58:26 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:41454: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:58:11 dovecot_login authenticator failed for H=(aXqj4iXZ6) [178.16.54.22]:49347: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:58:10 dovecot_login authenticator failed for H=(z07QW7) [84.239.7.19]:1139: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:58:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:58:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-02-01 04:58:17 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:50227: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.162.20
country_id: 1835841
description:
2026-02-01 04:58:25 dovecot_login authenticator failed for H=([1.241.162.20]) [1.241.162.20]:33702: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:58:21 dovecot_login authenticator failed for H=(BYfVgj) [45.94.31.131]:60987: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:58:45 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50007: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:59:16 dovecot_login authenticator failed for H=(UvvzeLB) [84.239.7.19]:35521: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:59:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:59:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65131: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-01 04:59:53 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:45283: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:59:21 dovecot_login authenticator failed for H=(7ryU4rT) [45.94.31.131]:58932: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-01 04:59:31 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:18292: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-02-01 04:59:37 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:50463: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 04:59:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:59:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54596: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:59:20 dovecot_login authenticator failed for H=(UW2IBI) [178.16.54.22]:60936: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:59:21 dovecot_login authenticator failed for H=(qAr61e5L3) [158.94.208.175]:53856: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2026-02-01 04:59:49 dovecot_login authenticator failed for H=([49.124.152.234]) [49.124.152.234]:60536: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:59:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-02-01 04:59:24 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:37909: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-02-01 05:00:01 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:47495: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:00:06 dovecot_login authenticator failed for H=(DhwfLGzUG) [178.16.54.22]:54939: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:00:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:00:11 dovecot_login authenticator failed for H=(PTRjpoM) [84.239.7.19]:4909: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:00:21 dovecot_login authenticator failed for H=(CBvqJXCv) [45.94.31.131]:58196: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:00:08 dovecot_login authenticator failed for H=(EdmEWDuub) [158.94.208.175]:56040: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:00:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2026-02-01 05:00:53 dovecot_login authenticator failed for H=145.47.246.220.static.netvigator.com [220.246.47.145]:55478: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:00:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62352: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:00:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:00:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61301: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-02-01 05:00:26 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:40635: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:01:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59759: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:01:15 dovecot_login authenticator failed for H=(g77YRM) [178.16.54.22]:63462: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-02-01 05:01:40 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:2222: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:01:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:01:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:01:22 dovecot_login authenticator failed for H=(Mp020K2) [45.94.31.131]:51300: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.235.154.114
country_id: 1814991
description:
2026-02-01 05:01:55 dovecot_login authenticator failed for H=([221.235.154.114]) [221.235.154.114]:57870: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:01:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:01:14 dovecot_login authenticator failed for H=(70VWIDkN) [84.239.7.19]:7103: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:01:18 dovecot_login authenticator failed for H=(lJTFrW) [158.94.208.175]:56082: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.167.226
country_id: 953987
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/nexuscollection.com/products/officechair/strand/strand.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:01:42 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49340: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:01:55 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59404: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:02:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:02:23 dovecot_login authenticator failed for H=(SZUZG1I0) [84.239.7.19]:25316: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 05:02:32 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:59974: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:02:56 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52272: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:02:24 dovecot_login authenticator failed for H=(WCBlskek) [178.16.54.22]:63197: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:02:02 dovecot_login authenticator failed for H=(Mib1jomNEd) [45.94.31.131]:50181: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:02:05 dovecot_login authenticator failed for H=(OI8MJPV7NN) [158.94.208.175]:51605: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:02:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:03:10 dovecot_login authenticator failed for H=(WX74Lbv) [178.16.54.22]:55108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:03:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54509: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:03:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:03:04 dovecot_login authenticator failed for H=(YYwujBdoB) [45.94.31.131]:63413: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:03:05 dovecot_login authenticator failed for H=(dKR5a1Oz) [84.239.7.19]:42270: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:03:14 dovecot_login authenticator failed for H=(yjIn72y6m) [158.94.208.175]:62258: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:04:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:04:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:04:19 dovecot_login authenticator failed for H=(3JuDacrD) [84.239.7.19]:23106: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:04:25 dovecot_login authenticator failed for H=(i18IChJfh) [158.94.208.175]:61836: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.187.230.104
country_id: 1269750
description:
Feb  1 05:04:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(122.187.230.104)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 05:04:40 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:58966: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.84.190.134
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activities.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:04:05 dovecot_login authenticator failed for H=(6WgfkFM) [45.94.31.131]:50369: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:04:19 dovecot_login authenticator failed for H=(EvM57piii) [178.16.54.22]:56522: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-01 05:04:23 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:52610: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.125
country_id: 6252001
description:
2026-02-01  5:04:36 202092 [Warning] Aborted connection 202092 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.125' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-02-01 05:04:42 dovecot_login authenticator failed for H=([101.13.4.128]) [101.13.4.128]:44464: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.150.147
country_id: 2661886
description:
2026-02-01 05:04:51 dovecot_login authenticator failed for H=h188-122-150-147.cust.bredband2.com [188.122.150.147]:57182: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:05:04 dovecot_login authenticator failed for H=(bXx537E77) [45.94.31.131]:63147: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:05:05 dovecot_login authenticator failed for H=(yvR4pGg) [178.16.54.22]:63828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:05:12 dovecot_login authenticator failed for H=(F4Uwq6Rs) [158.94.208.175]:60818: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:05:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50444: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:05:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:05:05 dovecot_login authenticator failed for H=(6hE7gw) [84.239.7.19]:21452: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:05:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:05:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:06:08 dovecot_login authenticator failed for H=(pVkiLn0) [45.94.31.131]:53367: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:06:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:06:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:06:28 dovecot_login authenticator failed for H=(vSSuG3tCtQ) [45.94.31.131]:58733: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.94.220.9
country_id: 1814991
description:
2026-02-01 05:06:29 dovecot_login authenticator failed for H=([183.94.220.9]) [183.94.220.9]:53126: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:06:16 dovecot_login authenticator failed for H=(xhVB7JW0) [84.239.7.19]:1450: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 05:06:50 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:39044: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:06:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52873: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:06:14 dovecot_login authenticator failed for H=(Lu2rCoY) [178.16.54.22]:61423: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:06:21 dovecot_login authenticator failed for H=(3WzA6thE) [158.94.208.175]:52032: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2026-02-01 05:06:40 dovecot_login authenticator failed for H=95-31-209-102.broadband.corbina.ru [95.31.209.102]:44669: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:07:22 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56092: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 05:07:36 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49242: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:07:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:07:23 dovecot_login authenticator failed for H=(Ffk9h3rw2) [178.16.54.22]:65021: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:07:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:07:08 dovecot_login authenticator failed for H=(FWuVlY7) [158.94.208.175]:52323: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:07:09 dovecot_login authenticator failed for H=(XXhHp7) [45.94.31.131]:52162: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:07:22 dovecot_login authenticator failed for H=(3YQsFZ) [84.239.7.19]:25448: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:08:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52200: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home/airefresh/public_html/images/sendto.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:08:08 dovecot_login authenticator failed for H=(psRXLsv) [84.239.7.19]:12491: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:08:18 dovecot_login authenticator failed for H=(SAlKVnSH) [158.94.208.175]:51486: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:08:09 dovecot_login authenticator failed for H=(zkmHOHe) [178.16.54.22]:65141: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:08:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2026-02-01 05:08:17 dovecot_login authenticator failed for H=([200.37.179.83]) [200.37.179.83]:45159: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2026-02-01 05:08:33 dovecot_login authenticator failed for H=(nhavuivn.com) [210.245.33.154]:48484: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:08:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:08:07 dovecot_login authenticator failed for H=(AmEUzmf) [45.94.31.131]:50732: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 05:08:30 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:46172: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:08:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:09:06 dovecot_login authenticator failed for H=(tgBSnh5O) [158.94.208.175]:53558: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:09:10 dovecot_login authenticator failed for H=(E6qaudkDj2) [45.94.31.131]:50851: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-02-01 05:09:15 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:30459: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:09:22 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54698: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-02-01 05:09:26 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:49332: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:09:03 dovecot_login authenticator failed for H=(FouMVJP1) [158.94.208.110]:56711: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:09:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1512 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)----||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:09:26 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50515: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:09:18 dovecot_login authenticator failed for H=(RCsV3J) [178.16.54.22]:54186: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV: and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)--||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/airefresh/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.178.30
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=49351514514756 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:09:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV: AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:09:20 dovecot_login authenticator failed for H=(lt996Mta) [84.239.7.19]:2892: 535 Incorrect authentication data (set_id=cofreth)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: PHP Injection Low value||MV: AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/feliogroupcom/public_html/product-details.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:10:09 dovecot_login authenticator failed for H=(aJ2gbyEIB) [45.94.31.131]:51215: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:10:15 dovecot_login authenticator failed for H=(uKGV5WrLu) [158.94.208.110]:52046: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:10:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:10:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:10:36 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56851: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.102.154
country_id: 1269750
description:
2026-02-01 05:10:44 dovecot_login authenticator failed for H=(static-154.102.107.27-tataidc.co.in) [27.107.102.154]:43678: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:10:15 dovecot_login authenticator failed for H=(T5N21vlFi6) [158.94.208.175]:57463: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:10:03 dovecot_login authenticator failed for H=(Ix3HVM) [84.239.7.19]:48890: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:10:04 dovecot_login authenticator failed for H=(U3XweKWe) [178.16.54.22]:55226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-02-01 05:10:51 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:58043: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-02-01 05:11:19 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (coelis) [68.82.141.145]:40614: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:11:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:11:09 dovecot_login authenticator failed for H=(wW49h24KTs) [84.239.7.19]:14158: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:11:10 dovecot_login authenticator failed for H=(b77kcN) [45.94.31.131]:62682: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:11:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:11:34 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50594: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:11:01 dovecot_login authenticator failed for H=(ZUfdUka) [158.94.208.110]:59994: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:11:13 dovecot_login authenticator failed for H=(7qc3Chm) [178.16.54.22]:56782: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.249.224.37
country_id: 2661886
description:
2026-02-01 05:11:22 dovecot_plain authenticator failed for H=c83-249-224-37.bredband.tele2.se (umented) [83.249.224.37]:59984: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-02-01 05:11:27 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (pousnes) [2.135.31.74]:38300: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:11:02 dovecot_login authenticator failed for H=(ADe8dtYZM) [158.94.208.175]:59406: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:12:03 dovecot_login authenticator failed for H=(ZxXilguvbo) [141.98.11.11]:58617: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:12:13 dovecot_login authenticator failed for H=(ETr5M2IW) [158.94.208.110]:57089: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:12:14 dovecot_login authenticator failed for H=(fb2XJZ7U) [84.239.7.19]:37460: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.159.218
country_id: 1814991
description:
2026-02-01 05:12:39 dovecot_login authenticator failed for H=([221.224.159.220]) [221.224.159.218]:56696: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:12:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63383: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:12:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:12:22 dovecot_login authenticator failed for H=(xdeTcAWK9) [178.16.54.22]:50159: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.128
country_id: 2186224
description:
2026-02-01 05:12:49 dovecot_login authenticator failed for H=([121.73.163.128]) [121.73.163.128]:34128: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:12:13 dovecot_login authenticator failed for H=(QIUxDHQ) [158.94.208.175]:61324: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:12:14 dovecot_login authenticator failed for H=(D0XSZR) [45.94.31.131]:58422: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:12:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63411: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:12:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:13:13 dovecot_login authenticator failed for H=(IKvhaQ) [45.94.31.131]:56909: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:13:24 dovecot_login authenticator failed for H=(y3pRaur) [158.94.208.110]:52023: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:13:23 dovecot_login authenticator failed for H=(6miOlK) [84.239.7.19]:38659: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:13:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:13:01 dovecot_login authenticator failed for H=(sIjiDDJA2) [141.98.11.11]:64311: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:13:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:13:08 dovecot_login authenticator failed for H=(6LpcC7) [178.16.54.22]:60373: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:13:22 dovecot_login authenticator failed for H=(pxSWUYDwI) [158.94.208.175]:52046: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-02-01 05:13:47 dovecot_plain authenticator failed for H=(clizers) [5.32.22.218]:44082: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:14:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:and 1= AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- and 1=1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:14:52 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:65203: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:14:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:14:17 dovecot_login authenticator failed for H=(nUvPP2kA) [141.98.11.11]:61574: 535 Incorrect authentication data (set_id=oichingching)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:and 1= and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)-- and 1=1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: PHP Injection Low value||MV:and 1= AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- and 1=1||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/feliogroupcom/public_html/product-details.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1512' or (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and '1'='1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:14:09 dovecot_login authenticator failed for H=(i4PZfJjd) [84.239.7.19]:31859: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:14:17 dovecot_login authenticator failed for H=(XdIZAPI) [178.16.54.22]:50354: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:14:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:14:07 dovecot_login authenticator failed for H=(OI85jj) [158.94.208.175]:57827: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:14:12 dovecot_login authenticator failed for H=(7lpAxEb) [45.94.31.131]:57296: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:14:12 dovecot_login authenticator failed for H=(YIAsweCC) [158.94.208.110]:59969: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:15:16 dovecot_login authenticator failed for H=(6863vB) [158.94.208.175]:54569: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:15:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55219: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:15:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:15:18 dovecot_login authenticator failed for H=(pJiRvM) [185.36.81.54]:64367: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:15:03 dovecot_login authenticator failed for H=(HeP0Lu) [178.16.54.22]:58941: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:15:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58687: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.107.199.180
country_id: 1880251
description:
[2026-02-01 05:15:08 +0800] info [webmaild] 103.107.199.180 - 2095central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:15:11 dovecot_login authenticator failed for H=(6k9ZIH) [45.94.31.131]:63226: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:15:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:15:13 dovecot_login authenticator failed for H=(QdFXnxcG) [84.239.7.19]:28430: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:15:20 dovecot_login authenticator failed for H=(oYEEe7) [141.98.11.11]:56250: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:16:12 dovecot_login authenticator failed for H=(qKjtRI) [178.16.54.22]:56712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 05:16:29 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:33488: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:16:01 dovecot_login authenticator failed for H=(lqd55K4) [84.239.7.19]:58366: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 05:16:02 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:50148: 535 Incorrect authentication data (set_id=enquiry@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:16:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:16:09 dovecot_login authenticator failed for H=(Gf5mDdK) [141.98.11.11]:54412: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-02-01 05:16:43 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:44844: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-02-01 05:16:47 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:51494: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-01 05:16:51 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:34108: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:16:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:16:07 dovecot_login authenticator failed for H=(XdNjAXRQz) [185.36.81.54]:57892: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:16:18 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53386: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:16:03 dovecot_login authenticator failed for H=(ZJ5XmXKk) [158.94.208.175]:49405: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:16:11 dovecot_login authenticator failed for H=(BpdV2J) [45.94.31.131]:55409: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.34
country_id: 1269750
description:
2026-02-01 05:16:33 dovecot_login authenticator failed for H=([203.145.159.97]) [182.95.231.34]:40280: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 05:17:24 H=([167.148.167.71]) [167.148.167.71]:64171 F=<Support@symphony-led.com> rejected RCPT <joseph@symphony-led.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:17:33 dovecot_login authenticator failed for H=(d9j9BV5492) [45.94.31.131]:63752: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.86
country_id: 1269750
description:
2026-02-01 05:17:48 dovecot_login authenticator failed for H=([125.23.237.86]) [125.23.237.86]:46152: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:17:06 dovecot_login authenticator failed for H=(sv5DMYl) [84.239.7.19]:31609: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:17:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:17:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58702: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:17:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:17:19 dovecot_login authenticator failed for H=(ww3qiUQ) [185.36.81.54]:62101: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:17:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:17:31 dovecot_login authenticator failed for H=(sVvbNoPG) [141.98.11.11]:53855: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:17:12 dovecot_login authenticator failed for H=(K55EzmrCx) [45.94.31.131]:59395: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:17:21 dovecot_login authenticator failed for H=(C9f7BUUGsY) [178.16.54.22]:53236: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:17:12 dovecot_login authenticator failed for H=(l3oP60W) [158.94.208.175]:49358: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-02-01 05:17:13 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:48650: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.11
country_id: 1814991
description:
2026-02-01 05:17:28 dovecot_login authenticator failed for H=([27.45.232.11]) [27.45.232.11]:44576: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:18:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:18:08 dovecot_login authenticator failed for H=(NZ6rdk) [141.98.11.11]:59182: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:18:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:18:22 dovecot_login authenticator failed for H=(uN2OC2UR) [158.94.208.175]:64744: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:18:07 dovecot_login authenticator failed for H=(SoMoWDk) [178.16.54.22]:63755: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:18:13 dovecot_login authenticator failed for H=(jNyDZ75) [45.94.31.131]:64782: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:18:51 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62995: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:18:11 dovecot_login authenticator failed for H=(aerzh2) [84.239.7.19]:21799: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:18:21 dovecot_login authenticator failed for H=(phVAmWO) [185.36.81.54]:49301: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-02-01 05:19:02 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:53681: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-02-01 05:19:56 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:55458: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:19:39 dovecot_login authenticator failed for H=(WYmm6y5mqQ) [185.36.81.54]:50595: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:19:08 dovecot_login authenticator failed for H=(8PsXH5d) [158.94.208.175]:56473: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:19:13 dovecot_login authenticator failed for H=(QJ42JtCDji) [45.94.31.131]:61764: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:19:15 dovecot_login authenticator failed for H=(zKPNq3VI) [84.239.7.19]:5704: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:19:16 dovecot_login authenticator failed for H=(9yFsCA) [178.16.54.22]:59049: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 05:19:41 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:49876: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:19:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50798: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:19:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:19:32 dovecot_login authenticator failed for H=(L2lMLOoB5) [141.98.11.11]:55024: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.122
country_id: 1210997
description:
2026-02-01 05:20:11 dovecot_login authenticator failed for H=([49.0.36.122]) [49.0.36.122]:54994: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:20:18 dovecot_login authenticator failed for H=(iXzZkarfW2) [158.94.208.175]:60604: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-02-01 05:20:05 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:57988: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-02-01 05:20:15 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:51742: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:20:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:20:27 dovecot_login authenticator failed for H=(195v4iG) [185.36.81.54]:53007: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:20:02 dovecot_login authenticator failed for H=(n5o2Eul) [84.239.7.19]:54857: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:20:02 dovecot_login authenticator failed for H=(b5OtEiKaa) [178.16.54.22]:57421: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:20:07 dovecot_login authenticator failed for H=(RuSYMxtv) [141.98.11.11]:57625: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:20:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49589: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:20:13 dovecot_login authenticator failed for H=(5JHkTNk65A) [45.94.31.131]:61985: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:20:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:21:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:21:04 dovecot_login authenticator failed for H=(oUEs9v) [158.94.208.175]:62427: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:21:10 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59233: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:21:14 dovecot_login authenticator failed for H=(EJj4MlKiw) [45.94.31.131]:62492: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:21:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:21:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:21:20 dovecot_login authenticator failed for H=(1RoUqa) [141.98.11.11]:55384: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:21:12 dovecot_login authenticator failed for H=(ounstbG9) [178.16.54.22]:60984: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:21:19 dovecot_login authenticator failed for H=(9OpMHU8o) [185.36.81.54]:56853: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:21:19 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61413: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-02-01 05:21:28 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (reind) [98.227.25.115]:54132: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:21:05 dovecot_login authenticator failed for H=(7KKoCSz) [84.239.7.19]:43304: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:22:15 dovecot_login authenticator failed for H=(wUWhUPuGhd) [45.94.31.131]:60092: 535 Incorrect authentication data (set_id=astpkg)


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 109.228.160.190
country_id: 2661886
domain: feliogroup.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/download.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:22:09 dovecot_login authenticator failed for H=(2sHPM84I) [185.36.81.54]:52935: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-02-01 05:22:44 dovecot_plain authenticator failed for H=(qualiting) [213.5.109.4]:59170: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.80.185
country_id: 690791
description:
2026-02-01 05:22:48 dovecot_plain authenticator failed for H=(nolifetard) [178.16.80.185]:59196: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:22:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:22:13 dovecot_login authenticator failed for H=(tT8xBcN3U2) [158.94.208.175]:52021: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:22:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:22:55 dovecot_login authenticator failed for H=(pg3OHH) [141.98.11.11]:62942: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:22:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:22:04 dovecot_login authenticator failed for H=(7XJ48YI) [84.239.7.19]:10964: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:22:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56827: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:22:21 dovecot_login authenticator failed for H=(aHQqGC2G) [178.16.54.22]:60815: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 05:22:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (inglaus) [87.103.126.54]:32434: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:23:16 dovecot_login authenticator failed for H=(zVqrQSYd) [45.94.31.131]:49422: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 05:23:26 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:39758: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:23:31 dovecot_login authenticator failed for H=(YVnbHUb) [141.98.11.11]:58528: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home2/agsaintifik/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:23:22 dovecot_login authenticator failed for H=(7tpsO3nPt) [158.94.208.175]:51947: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:23:22 dovecot_login authenticator failed for H=(4hjLxwJg0v) [185.36.81.54]:64525: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:23:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:23:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:23:16 dovecot_login authenticator failed for H=(lOtSxFiTzg) [84.239.7.19]:23177: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.6.11.184
country_id: 1814991
description:
2026-02-01 05:23:57 dovecot_login authenticator failed for H=([112.6.11.184]) [112.6.11.184]:53363: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:23:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.168.210.53
country_id: 6252001
description:
2026-02-01 05:23:44 dovecot_login authenticator failed for H=([166.168.210.53]) [166.168.210.53]:50207: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:23:07 dovecot_login authenticator failed for H=(R9Ubk7) [178.16.54.22]:60310: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 05:23:52 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:37148: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:23:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51827: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:23:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:24:16 dovecot_login authenticator failed for H=(DwYzfAHM) [178.16.54.22]:58348: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:24:08 dovecot_login authenticator failed for H=(k34pELCKj) [158.94.208.175]:55436: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:24:17 dovecot_login authenticator failed for H=(sPsIHd) [45.94.31.131]:50436: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:24:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/agsaintifik/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:24:04 dovecot_login authenticator failed for H=(gjFlRh9JN) [141.98.11.11]:52790: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 05:24:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:46255: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:24:20 dovecot_login authenticator failed for H=(yROPzKfQXQ) [84.239.7.19]:47031: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:24:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-02-01 05:24:16 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (quarele) [73.230.86.50]:48930: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:24:11 dovecot_login authenticator failed for H=(FSZXInsC) [185.36.81.54]:55889: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-02-01 05:24:29 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60769: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.150.168.226
country_id: 1814991
description:
2026-02-01 05:24:49 dovecot_login authenticator failed for H=([27.150.168.226]) [27.150.168.226]:44284: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:24:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63990: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:24:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 129.45.32.33
country_id: 2589581
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/contact.php||SC:/home2/feliogroupcom/public_html/images/contact.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:25:11 dovecot_login authenticator failed for H=(UJNlto) [141.98.11.11]:61887: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:25:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:25:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:25:39 dovecot_login authenticator failed for H=(GERHgYm) [158.94.208.175]:53223: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:25:16 dovecot_login authenticator failed for H=(GSfHCo7) [185.36.81.54]:54814: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:25:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61810: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 05:25:49 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:53490: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:25:02 dovecot_login authenticator failed for H=(EeO7EqNTNo) [178.16.54.22]:65094: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:25:03 dovecot_login authenticator failed for H=(ZR7o3VQ06B) [84.239.7.19]:13403: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 05:25:55 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:6639: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:25:48 dovecot_login authenticator failed for H=(TH3lH9Izt) [84.239.7.19]:12216: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:25:18 dovecot_login authenticator failed for H=(KkPZgiSoW) [45.94.31.131]:64805: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:26:24 dovecot_login authenticator failed for H=(cbyPkUNHgR) [45.94.31.131]:59908: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:26:02 dovecot_login authenticator failed for H=(AtkikbW) [158.94.208.175]:52925: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: stillman.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home2/stillman/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:26:13 dovecot_login authenticator failed for H=(PJHZeMD) [185.36.81.54]:59855: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:26:21 dovecot_login authenticator failed for H=(VN76j19Y) [141.98.11.11]:49696: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:26:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-02-01 05:26:11 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:55557: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:26:11 dovecot_login authenticator failed for H=(VbZPrya) [178.16.54.22]:62844: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:26:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 05:26:04 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:57858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:26:09 dovecot_login authenticator failed for H=(xjS0Swmg) [84.239.7.19]:33194: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:27:20 dovecot_login authenticator failed for H=(akkn19n) [178.16.54.22]:54421: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:27:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49937: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/agsaintifik/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 05:27:40 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:43827: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 05:27:53 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:49834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:27:05 dovecot_login authenticator failed for H=(KDHqv2hBNJ) [45.94.31.131]:62183: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:27:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:27:11 dovecot_login authenticator failed for H=(3JY0fe) [158.94.208.175]:55323: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:27:14 dovecot_login authenticator failed for H=(NhDITXremV) [84.239.7.19]:25364: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:27:04 dovecot_login authenticator failed for H=(dPGfC7g) [141.98.11.11]:56811: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:27:08 dovecot_login authenticator failed for H=(Eq3NeCr1nz) [185.36.81.54]:50532: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:28:43 dovecot_login authenticator failed for H=(k0ICae5yJc) [158.94.208.215]:60487: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:28:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62303: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:28:06 dovecot_login authenticator failed for H=(8liVXYr) [178.16.54.22]:59357: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:28:20 dovecot_login authenticator failed for H=(4FjtOkI) [158.94.208.175]:57534: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:28:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:28:02 dovecot_login authenticator failed for H=(WEBCGbp) [185.36.81.54]:52551: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:28:05 dovecot_login authenticator failed for H=(P5vd6nGJR) [45.94.31.131]:56571: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:28:19 dovecot_login authenticator failed for H=(o6lkuzvZH) [84.239.7.19]:55633: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-01 05:28:30 dovecot_plain authenticator failed for H=(chandroyan) [176.113.155.132]:50507: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:28:33 dovecot_login authenticator failed for H=(borZB3OHBP) [141.98.11.11]:63315: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 05:28:09 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:37190: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2026-02-01 05:28:18 dovecot_login authenticator failed for H=([220.178.246.43]) [220.178.246.43]:42580: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 05:28:24 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:58566: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.167.187
country_id: 1814991
description:
2026-02-01 05:28:33 dovecot_login authenticator failed for H=([121.204.167.187]) [121.204.167.187]:48106: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:29:07 dovecot_login authenticator failed for H=(l9TKiNKdo) [158.94.208.215]:61431: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:29:49 dovecot_login authenticator failed for H=(gJw2Ex) [141.98.11.11]:62566: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:29:05 dovecot_login authenticator failed for H=(Dgm1tw6Dws) [45.94.31.131]:56389: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:29:15 dovecot_login authenticator failed for H=(FSGHjNozi) [178.16.54.22]:61101: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:29:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:29:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:29:19 dovecot_login authenticator failed for H=(ZSSUbnfl0x) [84.239.7.19]:41657: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:29:22 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63787: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:29:06 dovecot_login authenticator failed for H=(Z2vr7lS6z6) [158.94.208.175]:56975: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:29:13 dovecot_login authenticator failed for H=(IeGx4nn) [185.36.81.54]:50176: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 169.150.203.247
country_id: 6252001
domain: cabe.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/2018/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:30:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:30:15 dovecot_login authenticator failed for H=(zOeETGea) [158.94.208.175]:65043: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:30:15 dovecot_login authenticator failed for H=(6RQ1sSk8I) [84.239.7.19]:40207: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:30:19 dovecot_login authenticator failed for H=(q6Q5w8) [158.94.208.215]:56194: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:30:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:30:26 dovecot_login authenticator failed for H=(7WhoNNaSA) [45.94.31.131]:53181: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
country_id: 1814991
description:
2026-02-01 05:30:53 dovecot_login authenticator failed for H=([222.189.211.114]) [222.189.211.114]:35192: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:30:24 dovecot_login authenticator failed for H=(hkBm5Xw7) [178.16.54.22]:50604: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:30:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:30:20 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57732: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:30:24 dovecot_login authenticator failed for H=(nmHoB7p) [141.98.11.11]:52149: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:30:05 dovecot_login authenticator failed for H=(miApyXCpkb) [45.94.31.131]:64269: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:30:09 dovecot_login authenticator failed for H=(TKD4gN) [185.36.81.54]:62689: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-02-01 05:31:03 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:47884: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:31:06 dovecot_login authenticator failed for H=(JV6pRwVAe) [84.239.7.19]:12886: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:31:24 dovecot_login authenticator failed for H=(b0XCGGN2u) [158.94.208.175]:60868: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:31:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61517: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:31:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:31:07 dovecot_login authenticator failed for H=(8y39cKrYk) [158.94.208.215]:50418: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:31:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:31:10 dovecot_login authenticator failed for H=(SqEX2Jy) [178.16.54.22]:57301: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:31:10 dovecot_login authenticator failed for H=(sSqWiv42) [185.36.81.54]:65242: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:31:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61163: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:31:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:31:07 dovecot_login authenticator failed for H=(KSudvUKX) [45.94.31.131]:63877: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:31:20 dovecot_login authenticator failed for H=(Y8mGOEXY) [141.98.11.11]:59488: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:31:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:32:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:32:27 dovecot_login authenticator failed for H=(aQmpd5yN) [141.98.11.11]:64683: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:32:37 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55323: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.185.80.128
country_id: 6252001
description:
2026-02-01 05:32:33 dovecot_login authenticator failed for H=(localhost.localdomain) [89.185.80.128]:50076: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


