# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2026-01-31 08:22:27 dovecot_login authenticator failed for H=([121.134.31.193]) [121.134.31.193]:51056: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:23:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.233.127.218
country_id: 2017370
description:
2026-01-31 08:23:26 dovecot_login authenticator failed for H=(dsl-94-233-127-218.avtlg.ru) [94.233.127.218]:49772: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.135
country_id: 1835841
description:
2026-01-31 08:23:35 dovecot_login authenticator failed for H=([121.131.220.135]) [121.131.220.135]:33036: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.179.59
country_id: 953987
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-more.php?id=608309 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:23:07 dovecot_login authenticator failed for H=(VRTmsB0) [158.94.209.22]:64240: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:24:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:24:01 dovecot_login authenticator failed for H=(oEnrK4qk0) [158.94.209.22]:63239: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.236.21.232
country_id: 3469034
domain: acburn.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78934.acburn.com.my||ServerName:acburn.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c545781426dc0bc823df5c0eaebb79124c00376||Title:0xc1112b26||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: wohcheong.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/woh/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-01-31 08:24:58 dovecot_login authenticator failed for H=([1.250.67.190]) [1.250.67.190]:60574: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:24:01 dovecot_login authenticator failed for H=(E98LB6A) [158.94.209.22]:63230: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:25:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:25:13 dovecot_login authenticator failed for H=(ozaKkRL16) [158.94.209.22]:59281: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-01-31 08:25:59 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:54839: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 08:25:07 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:41407: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-31 08:25:46 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:43624: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:26:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:26:07 dovecot_login authenticator failed for H=(RPI6f4Se) [158.94.209.22]:49817: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-31 08:26:56 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:39554: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 08:26:18 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:51748: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.0.81.84
country_id: 1814991
description:
2026-01-31 08:26:21 dovecot_login authenticator failed for H=([111.0.81.84]) [111.0.81.84]:34852: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2026-01-31 08:26:37 dovecot_login authenticator failed for H=(066249.telemar.net.br) [200.216.172.182]:59246: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:26:07 dovecot_login authenticator failed for H=(n39jx6rFz) [158.94.209.22]:49780: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.159.230
country_id: 1835841
description:
2026-01-31 08:26:08 dovecot_login authenticator failed for H=([220.72.159.230]) [220.72.159.230]:41876: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 08:26:44 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:34742: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-31 08:27:01 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:53631: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/agsaintifik/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:27:01 dovecot_login authenticator failed for H=(ANtzb3) [158.94.209.22]:58115: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.100.124.153
country_id: 2017370
description:
2026-01-31 08:27:10 dovecot_login authenticator failed for H=([176.100.124.153]) [176.100.124.153]:39584: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-31 08:27:31 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:36118: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2026-01-31 08:27:45 dovecot_login authenticator failed for H=([121.134.31.193]) [121.134.31.193]:60588: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.167.185.20
country_id: 1562822
description:
2026-01-31 08:27:03 dovecot_plain authenticator failed for H=(d1qurf0ac99o7sdx) [14.167.185.20]:60636: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:27:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 08:27:18 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:36207: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-31 08:27:28 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:35330: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.73.26
country_id: 1814991
description:
2026-01-31 08:27:18 dovecot_login authenticator failed for H=([14.20.73.26]) [14.20.73.26]:36550: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.9
country_id: 1814991
description:
2026-01-31 08:28:01 dovecot_login authenticator failed for H=([114.242.61.9]) [114.242.61.9]:60760: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2026-01-31 08:28:47 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:42307: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-31 08:28:35 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (ovens) [73.213.237.28]:35788: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 08:28:46 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:17391: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 08:28:11 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:33294: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:28:13 dovecot_login authenticator failed for H=(cdk07p) [158.94.209.22]:53734: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-31 08:28:34 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:51412: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.235
country_id: 1733045
description:
2026-01-31 08:28:40 dovecot_login authenticator failed for H=([49.124.152.235]) [49.124.152.235]:57536: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:28:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:28:13 dovecot_login authenticator failed for H=(z4ZpfFn5F) [158.94.209.22]:53751: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:29:07 dovecot_login authenticator failed for H=(sWumxk) [158.94.209.22]:57284: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 08:29:10 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:36113: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-31 08:29:32 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:15694: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:30:19 dovecot_login authenticator failed for H=(q0xFgbdm) [158.94.209.22]:63879: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-31 08:30:29 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:60197: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:30:01 dovecot_login authenticator failed for H=(WcCuon) [158.94.209.22]:54474: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.55.124
country_id: 3144096
description:
2026-01-31 08:30:18 dovecot_login authenticator failed for H=(cm-84.211.55.124.get.no) [84.211.55.124]:42169: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-31 08:30:37 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:53655: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.223
country_id: 1668284
description:
2026-01-31 08:30:45 dovecot_login authenticator failed for H=111-70-23-223.emome-ip.hinet.net [111.70.23.223]:38210: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.127.35
country_id: 3469034
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/contact.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:31:13 dovecot_login authenticator failed for H=(fgUMNAmD) [158.94.209.22]:58188: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.89.164.226
country_id: 2635167
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/photos/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:31:42 dovecot_login authenticator failed for H=(NXrvRbEck) [158.94.208.175]:49923: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-31 08:31:48 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:48490: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.64.42
country_id: 1668284
description:
2026-01-31 08:31:56 dovecot_login authenticator failed for H=124-11-64-42.static.tfn.net.tw [124.11.64.42]:40607: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:31:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.55.47
country_id: 1733045
description:
2026-01-31 08:31:37 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.55.47]:60626: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.208.26
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/06largescale-xls.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-01-31 08:33:00 dovecot_login authenticator failed for H=([61.37.150.35]) [61.37.150.6]:13990: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:32:13 dovecot_login authenticator failed for H=(ZkFLNdL) [158.94.208.175]:52212: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.55.47
country_id: 1733045
description:
2026-01-31 08:32:48 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.55.47]:60626: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:32:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42105.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fea57db67fd13d5b911fbc001ad8ef21a4dd0776||Title:0x863b8a55||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:32:07 dovecot_login authenticator failed for H=(F78qZs7) [158.94.209.22]:53986: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:32:25 dovecot_login authenticator failed for H=(cIG7BE) [158.94.209.22]:50171: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.194.254
country_id: 1522867
description:
2026-01-31 08:32:46 dovecot_login authenticator failed for H=95.56.194.254.dynamic.telecom.kz [95.56.194.254]:58366: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:33:17 dovecot_login authenticator failed for H=(MnVgIaKO) [158.94.208.175]:56726: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.0.66.248
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=514773 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:33:01 dovecot_login authenticator failed for H=(JqhctkOq) [158.94.209.22]:52370: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:33:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 08:34:43 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:47215: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-01-31 08:34:44 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:55204: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-01-31 08:34:56 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:53491: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:34:03 dovecot_login authenticator failed for H=(VNXsvgv) [158.94.208.175]:52290: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:34:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:34:13 dovecot_login authenticator failed for H=(YBNsHAi6) [158.94.209.22]:65432: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2026-01-31 08:34:24 dovecot_login authenticator failed for H=([223.210.27.53]) [223.210.27.53]:56624: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:34:31 dovecot_login authenticator failed for H=(9LivBZ) [158.94.209.22]:60671: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:35:03 dovecot_login authenticator failed for H=(stdogoQ) [158.94.208.175]:63234: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:35:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-01-31 08:35:11 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:34213: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-31 08:35:12 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:58738: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.130
country_id: 1149361
description:
2026-01-31 08:35:31 dovecot_login authenticator failed for H=([149.54.62.130]) [149.54.62.130]:33733: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:35:07 dovecot_login authenticator failed for H=(ZLnRWwx) [158.94.209.22]:63702: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-31 08:35:22 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:41364: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.190
country_id: 6252001
description:
2026-01-31  8:36:19 23382 [Warning] Aborted connection 23382 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.190' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:36:01 dovecot_login authenticator failed for H=(kx12fg6pB) [158.94.209.22]:63570: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:36:37 dovecot_login authenticator failed for H=(4WKrMR) [158.94.209.22]:64373: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:36:02 dovecot_login authenticator failed for H=(qzHyJ5) [158.94.208.175]:54233: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.232.232.10
country_id: 1643084
description:
Jan 31 08:37:53 sv3 pure-ftpd[3905740]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:37:13 dovecot_login authenticator failed for H=(mebAIZ) [158.94.209.22]:49360: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:37:11 dovecot_login authenticator failed for H=(Yqxl9I2NT) [158.94.208.175]:52391: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-01-31 08:38:14 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:34810: 535 Incorrect authentication data


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.232.232.10
country_id: 1643084
description:
Jan 31 08:38:32 sv3 pure-ftpd[3906083]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:38:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:38:07 dovecot_login authenticator failed for H=(6bS7JR3Wd9) [158.94.209.22]:57642: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:38:43 dovecot_login authenticator failed for H=(j1FD6w) [158.94.209.22]:58231: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:38:11 dovecot_login authenticator failed for H=(q7ljlWOY0) [158.94.208.175]:62722: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-31 08:39:54 dovecot_login authenticator failed for H=([60.8.73.174]) [60.8.73.174]:31654: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:39:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:39:09 dovecot_login authenticator failed for H=(BI5n5s3MI) [158.94.208.175]:54044: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:39:19 dovecot_login authenticator failed for H=(GUwdMt) [158.94.209.22]:62156: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:40:13 dovecot_login authenticator failed for H=(4lVsZj) [158.94.209.22]:53369: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:40:19 dovecot_login authenticator failed for H=(PhV0Vt) [158.94.208.175]:64321: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:40:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 08:40:33 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:60926: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:40:49 dovecot_login authenticator failed for H=(aNQ1qDAdM) [158.94.209.22]:56872: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.180.9
country_id: 2017370
description:
2026-01-31 08:41:31 dovecot_login authenticator failed for H=broadband-178-140-180-9.ip.moscow.rt.ru [178.140.180.9]:50656: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:41:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:41:07 dovecot_login authenticator failed for H=(RUAYMZ) [158.94.209.22]:54529: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 08:41:12 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:51386: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-31 08:41:38 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:46291: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 08:42:01 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:34416: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 08:41:40 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:6968: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 08:41:57 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:41038: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:41:17 dovecot_login authenticator failed for H=(JJg87y) [158.94.208.175]:53033: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.232.232.10
country_id: 1643084
description:
Jan 31 08:41:40 sv3 pure-ftpd[3909157]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 08:41:43 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:44450: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 08:42:17 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:48138: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 172.232.232.10
country_id: 1643084
description:
Jan 31 08:42:28 sv3 pure-ftpd[3909980]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 08:42:54 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:49049: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:42:55 dovecot_login authenticator failed for H=(KydToF) [158.94.209.22]:53135: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:42:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-01-31 08:42:29 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:56930: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.43
country_id: 6252001
description:
2026-01-31 08:42:38 dovecot_login authenticator failed for H=(ADMIN) [37.19.221.43]:16550: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:42:03 dovecot_login authenticator failed for H=(15EfAcAE) [158.94.208.175]:61849: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 172.232.232.10
country_id: 1643084
domain: 42.0.28.70
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/base.inc||User:cabecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:42:19 dovecot_login authenticator failed for H=(qlifEWmJW) [158.94.209.22]:54083: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.232.232.10
country_id: 1643084
description:
Jan 31 08:42:25 sv3 pure-ftpd[3909791]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:43:05 dovecot_login authenticator failed for H=(lHBgztU) [158.94.208.175]:64251: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:43:13 dovecot_login authenticator failed for H=(WHz0PPw5iu) [158.94.209.22]:49522: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.162
country_id: 2750405
description:
2026-01-31  8:43:03 23634 [Warning] Aborted connection 23634 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.162' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:43:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:44:14 dovecot_login authenticator failed for H=(QZbc8jXyM) [158.94.208.175]:57536: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.173.227
country_id: 2017370
description:
2026-01-31 08:44:46 dovecot_login authenticator failed for H=([109.202.173.227]) [109.202.173.227]:50223: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:45:01 dovecot_login authenticator failed for H=(BMNWkgS) [158.94.209.22]:56672: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 08:44:29 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:19002: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:44:07 dovecot_login authenticator failed for H=(1FqcgmD9) [158.94.209.22]:64375: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 08:44:53 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:45485: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-01-31 08:44:26 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:36708: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-01-31 08:44:35 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:34214: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.232.88
country_id: 3439705
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/away/680/611735 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-01-31 08:45:15 dovecot_login authenticator failed for H=([218.156.2.230]) [218.156.2.229]:44180: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:45:19 dovecot_login authenticator failed for H=(EmLBBL) [158.94.209.22]:64109: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:45:22 dovecot_login authenticator failed for H=(ULhlvJ) [158.94.208.175]:56950: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 72.167.150.128
country_id: 6252001
domain: af-sb.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users?per_page=20||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.32.167
country_id: 6252001
description:
[2026-01-31 08:45:09 +0800] info [webmaild] 45.3.32.167 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:46:13 dovecot_login authenticator failed for H=(hIx5l5Ql) [158.94.209.22]:57968: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:46:26 dovecot_login authenticator failed for H=(Aoz1Esduc) [158.94.208.175]:59453: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-01-31 08:46:31 dovecot_login authenticator failed for H=([121.142.146.165]) [121.142.146.165]:39782: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: vtgroupsb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/vtgroupsb/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:46:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.8.202
country_id: 732800
description:
[2026-01-31 08:46:03 +0800] info [webmaild] 95.164.8.202 - intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-01-31 08:46:22 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:37514: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 08:46:42 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:33432: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-01-31 08:47:11 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:44901: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:47:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.124.112
country_id: 3469034
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/images/son.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-31 08:47:02 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:55138: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:47:06 dovecot_login authenticator failed for H=(MbbN22Nu) [158.94.208.175]:60469: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:47:07 dovecot_login authenticator failed for H=(DnNskH8) [158.94.209.22]:54617: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:47:07 dovecot_login authenticator failed for H=(pMhfjn8) [158.94.209.22]:54609: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:48:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:48:19 dovecot_login authenticator failed for H=(1cKj92i) [158.94.209.22]:55953: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:48:23 dovecot_login authenticator failed for H=(fwS1HNee) [158.94.208.175]:55268: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:49:13 dovecot_login authenticator failed for H=(SeyWCfsfY) [158.94.209.22]:55639: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:49:24 dovecot_login authenticator failed for H=(JtcZjJSH) [158.94.208.175]:57634: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:49:13 dovecot_login authenticator failed for H=(1jhlG77SNF) [158.94.209.22]:55680: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.214.44.43
country_id: 2635167
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/indoor-led-screen-mobile-series/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 37.187.29.212
country_id: 3017382
domain: af-sb.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/2?_fields=slug||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:50:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.186.183.88
country_id: 2017370
description:
2026-01-31 08:50:19 dovecot_login authenticator failed for H=(188x186x183x88.dynamic.tmn.ertelecom.ru) [188.186.183.88]:40275: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 163.44.185.98
country_id: 1861060
domain: af-sb.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users?per_page=10||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:50:05 dovecot_login authenticator failed for H=(z0LVGX0pl) [158.94.208.175]:50669: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:50:07 dovecot_login authenticator failed for H=(8Zvhm85d) [158.94.209.22]:64423: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.64.42
country_id: 1668284
description:
2026-01-31 08:50:34 dovecot_login authenticator failed for H=124-11-64-42.static.tfn.net.tw [124.11.64.42]:58044: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 08:50:36 dovecot_login authenticator failed for H=(GNKd5OY) [185.91.69.136]:61892: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-31 08:50:52 dovecot_plain authenticator failed for H=(swite) [102.53.15.180]:43587: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:51:01 dovecot_login authenticator failed for H=(ppa4D1tkJ) [158.94.209.22]:54283: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.25.188
country_id: 6252001
description:
2026-01-31 08:51:05 dovecot_plain authenticator failed for H=(ja9fa2b6wxgny8mhmum7bx15cdww7u1) [68.183.25.188]:57358: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:51:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:51:19 dovecot_login authenticator failed for H=(DR2Ve12) [158.94.209.22]:55388: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 08:51:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 08:51:40 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:42106: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 08:51:23 dovecot_login authenticator failed for H=(e3nRcEkEq6) [185.91.69.136]:51522: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:51:22 dovecot_login authenticator failed for H=(nciVVwtE) [158.94.208.175]:57063: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-31 08:51:58 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:50576: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.112.89.138
country_id: 6251999
description:
2026-01-31 08:52:13 dovecot_login authenticator failed for H=ipagstaticip-26846e71-b733-4d8b-bfa7-a49755089ffe.sdsl.bell.ca [142.112.89.138]:59732: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-31 08:52:20 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:43270: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:52:13 dovecot_login authenticator failed for H=(l9wFriak) [158.94.209.22]:51674: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2026-01-31 08:52:14 dovecot_login authenticator failed for H=([223.197.153.144]) [223.197.153.144]:58938: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 08:52:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:52:10 dovecot_login authenticator failed for H=(GLSmXoe) [158.94.208.175]:59693: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.244.184
country_id: 1694008
domain: advisorygroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.advisorygroup.com.my||ServerName:advisorygroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 08:52:13 dovecot_login authenticator failed for H=(gj920NL) [185.91.69.136]:56653: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:53:07 dovecot_login authenticator failed for H=(MTzqLao22h) [158.94.209.22]:55483: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 08:53:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:53:07 dovecot_login authenticator failed for H=(njD4hF4Dpy) [158.94.208.175]:63707: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 08:53:23 dovecot_login authenticator failed for H=(z8px4zSG) [185.91.69.136]:65447: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:53:25 dovecot_login authenticator failed for H=(JGr97PG) [158.94.209.22]:51074: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 08:54:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:54:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:54:09 dovecot_login authenticator failed for H=(KMSvdeh) [158.94.208.175]:60388: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2026-01-31 08:54:56 dovecot_login authenticator failed for H=([211.178.165.251]) [211.178.165.251]:39373: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.100.63.198
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73401515569897 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:54:01 dovecot_login authenticator failed for H=(9NYg297) [158.94.209.22]:54219: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-31 08:54:23 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:46863: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-31 08:55:13 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:49586: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 08:55:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
country_id: 1814991
description:
2026-01-31 08:55:52 dovecot_login authenticator failed for H=mail.toptronicsinc.com [218.4.156.254]:52176: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-01-31 08:55:36 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:36709: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.128.177.147
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/about.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:55:03 dovecot_login authenticator failed for H=(HEkqq0kL) [158.94.208.175]:57325: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:55:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:55:13 dovecot_login authenticator failed for H=(oKcZORUk) [158.94.209.22]:62912: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:55:31 dovecot_login authenticator failed for H=(nblzcV) [158.94.209.22]:50907: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:56:25 dovecot_login authenticator failed for H=(ZXzK6uJ9b) [158.94.208.175]:53328: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 08:56:41 dovecot_login authenticator failed for H=(iqq4UvA) [92.118.39.145]:59492: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:56:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:56:07 dovecot_login authenticator failed for H=(UFTfQkbb1) [158.94.209.22]:56121: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-01-31 08:57:36 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.204]:7292: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:57:01 dovecot_login authenticator failed for H=(JjXz4UjpU) [158.94.209.22]:55765: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:57:37 dovecot_login authenticator failed for H=(vhiOVZt) [158.94.209.22]:49749: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: tptec.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/tptecadmin/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-01-31 08:57:23 dovecot_login authenticator failed for H=([1.237.155.150]) [1.237.155.150]:47026: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:57:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:57:23 dovecot_login authenticator failed for H=(IxXHEITrK) [158.94.208.175]:54999: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 08:57:08 dovecot_login authenticator failed for H=(fJBb8o) [92.118.39.145]:60460: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:58:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 88.214.3.181
country_id: 660013
domain: www.inter-link.edu.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:58:20 dovecot_login authenticator failed for H=(MetUZlF) [158.94.208.175]:61437: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:58:13 dovecot_login authenticator failed for H=(xvn26zbhMe) [158.94.209.22]:52988: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 08:58:15 dovecot_login authenticator failed for H=(X1ilQ00X) [92.118.39.145]:63316: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 08:59:01 dovecot_login authenticator failed for H=(b9kebNP2OY) [92.118.39.145]:65356: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: mail.jabezinnovations.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769821142_8076',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:59:43 dovecot_login authenticator failed for H=(nT1yTTySt) [158.94.209.22]:56443: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:59:07 dovecot_login authenticator failed for H=(NOoNRA) [158.94.209.22]:60543: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:59:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 08:59:22 dovecot_login authenticator failed for H=(x7nEx7) [158.94.208.175]:50814: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.130
country_id: 1149361
description:
2026-01-31 08:59:26 dovecot_login authenticator failed for H=([149.54.62.130]) [149.54.62.130]:60060: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
country_id: 1814991
description:
2026-01-31 08:59:36 dovecot_login authenticator failed for H=([61.185.30.170]) [61.185.30.170]:45487: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.120.236.26
country_id: 2802361
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83476.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b5beae39eebd148a383aec8896df8a8091df635c||Title:0xcec66779||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-01-31 09:00:20 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:52726: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:00:01 dovecot_login authenticator failed for H=(Bw3KX16LO) [158.94.209.22]:50562: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:00:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:00:09 dovecot_login authenticator failed for H=(nhe3r0) [158.94.208.175]:49240: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:00:09 dovecot_login authenticator failed for H=(jya051) [92.118.39.145]:51703: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.134
country_id: 6252001
description:
2026-01-31 09:00:41 dovecot_login authenticator failed for H=([209.23.73.134]) [209.23.73.134]:49070: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 09:00:41 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:50718: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:01:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:01:17 dovecot_login authenticator failed for H=(rUx9vS) [92.118.39.145]:54924: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/eco.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:01:08 dovecot_login authenticator failed for H=(KVx5rGh91s) [158.94.208.175]:51607: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-31 09:01:23 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:39173: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:01:49 dovecot_login authenticator failed for H=(v9mpPTnd) [158.94.209.22]:50540: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:51690.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9f79cf64b3676c76323dc8643a890feea34e7609||Title:0xa22692ec||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 09:01:40 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:53720: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:01:13 dovecot_login authenticator failed for H=(qPR0kC6Ru) [158.94.209.22]:51619: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.70.147
country_id: 2802361
description:
2026-01-31 09:02:17 dovecot_login authenticator failed for H=147.70.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.70.147]:57108: 535 Incorrect authentication data (set_id=ita@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:02:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:02:02 dovecot_login authenticator failed for H=(yfpO1VZ5) [92.118.39.145]:56847: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:02:03 dovecot_login authenticator failed for H=(H9hcZ9Po) [158.94.208.175]:62406: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:02:07 dovecot_login authenticator failed for H=(SMkopVOapo) [158.94.209.22]:60928: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:02:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:03:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:03:55 dovecot_login authenticator failed for H=(7DhYDgiCXE) [158.94.209.22]:52372: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:03:01 dovecot_login authenticator failed for H=(inhZ06) [158.94.209.22]:63353: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:03:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.13
country_id: 3625428
description:
2026-01-31 09:03:37 dovecot_login authenticator failed for H=(ADMIN) [95.181.237.13]:48839: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:03:13 dovecot_login authenticator failed for H=(g4mo4z) [92.118.39.145]:59533: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:03:21 dovecot_login authenticator failed for H=(QLG5oa) [158.94.208.175]:51708: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:04:13 dovecot_login authenticator failed for H=(dpGrwOORGc) [158.94.209.22]:54929: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.65.226.250
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.187.7.14
country_id: 1835841
description:
2026-01-31 09:04:43 dovecot_login authenticator failed for H=([211.187.7.14]) [211.187.7.14]:48338: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:04:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:04:05 dovecot_login authenticator failed for H=(1AdN4UtGZe) [92.118.39.145]:62193: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2026-01-31 09:04:59 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:43872: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:04:03 dovecot_login authenticator failed for H=(bAoXYW02) [158.94.208.175]:59503: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:04:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.68.173.135
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-31 09:05:43 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:34912: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:05:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:05:07 dovecot_login authenticator failed for H=(rVKfOEyAO4) [158.94.209.22]:63567: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:05:20 dovecot_login authenticator failed for H=(jYMfib1c) [92.118.39.145]:65047: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:05:04 dovecot_login authenticator failed for H=(uaBYd53Mn) [158.94.208.175]:52532: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2026-01-31 09:05:35 dovecot_login authenticator failed for H=([61.150.123.106]) [61.150.123.106]:34820: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:06:01 dovecot_login authenticator failed for H=(VqMm0WNrh) [158.94.209.22]:52423: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:06:01 dovecot_login authenticator failed for H=(5boKfPwr9M) [158.94.209.22]:52470: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:06:06 dovecot_login authenticator failed for H=(uTVILqiZ) [92.118.39.145]:50652: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:06:10 dovecot_login authenticator failed for H=(4sTGlu) [158.94.208.175]:51229: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:06:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-01-31 09:06:45 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:40078: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 09:07:01 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:33800: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-31 09:07:31 dovecot_login authenticator failed for H=([125.17.205.185]) [182.95.178.122]:59556: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:07:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 09:07:50 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:42979: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 09:07:04 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:51862: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:07:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:07:13 dovecot_login authenticator failed for H=(Yci93vpG) [158.94.209.22]:60370: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 09:07:20 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:52174: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.250.185.130
country_id: 2542007
description:
2026-01-31 09:07:49 dovecot_login authenticator failed for H=(uClML6ci) [41.250.185.130]:55784: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 09:07:50 dovecot_login authenticator failed for H=(I49GPPNubB) [69.5.189.21]:52105: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:07:14 dovecot_login authenticator failed for H=(J4HZeasTyo) [92.118.39.145]:53563: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 09:07:36 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:41636: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-31 09:07:57 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:38967: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 09:07:09 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:27142: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.137.146.55
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-detail8.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:07:13 dovecot_login authenticator failed for H=(rwfzX6mP) [158.94.208.175]:60961: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:08:07 dovecot_login authenticator failed for H=(IDRZgHie) [158.94.209.22]:49646: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 09:08:55 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:60130: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:08:07 dovecot_login authenticator failed for H=(IAXpoV4x) [158.94.209.22]:49870: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.105.66
country_id: 1814991
description:
2026-01-31 09:08:13 dovecot_login authenticator failed for H=([61.160.105.66]) [61.160.105.66]:45413: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 09:08:14 dovecot_login authenticator failed for H=(v0Xo1jEAP) [69.5.189.21]:56067: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:08:21 dovecot_login authenticator failed for H=(dFRCFQdOhr) [92.118.39.145]:56296: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:08:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:08:25 dovecot_login authenticator failed for H=(7ONeikV) [158.94.208.175]:57983: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 09:08:44 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:16512: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-31 09:09:56 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:39556: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-31 09:09:10 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (poismilly) [73.230.86.50]:39006: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:09:23 dovecot_login authenticator failed for H=(rOU0K6e9) [158.94.208.175]:64160: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-31 09:09:45 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:45157: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:09:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:09:19 dovecot_login authenticator failed for H=(q7IGdMowi) [158.94.209.22]:62403: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 09:10:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (laicro) [87.103.126.54]:22651: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:09:07 dovecot_login authenticator failed for H=(zSiOhNJl) [92.118.39.145]:58236: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.110
country_id: 1733045
description:
2026-01-31 09:09:35 dovecot_login authenticator failed for H=([49.124.147.110]) [49.124.147.110]:55376: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-31 09:09:48 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:57291: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-01-31 09:09:52 dovecot_login authenticator failed for H=([1.227.228.131]) [1.227.228.131]:39808: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.37
country_id: 1814991
description:
2026-01-31 09:09:55 dovecot_login authenticator failed for H=([111.26.62.37]) [111.26.62.37]:46674: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:10:18 dovecot_login authenticator failed for H=(lsZFEg0L) [158.94.208.175]:63567: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:10:13 dovecot_login authenticator failed for H=(alhq4o) [158.94.209.22]:50260: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:10:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:10:16 dovecot_login authenticator failed for H=(BQrPb2ej) [92.118.39.145]:61206: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:10:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:10:13 dovecot_login authenticator failed for H=(IIRCxuB) [158.94.209.22]:50257: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2026-01-31 09:11:33 dovecot_login authenticator failed for H=([182.95.124.206]) [182.95.124.206]:40714: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:11:02 dovecot_login authenticator failed for H=(c68LlJ6rn) [92.118.39.145]:63478: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:11:02 dovecot_login authenticator failed for H=(DvV9yuaFEY) [158.94.208.175]:49591: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:11:07 dovecot_login authenticator failed for H=(nbRTUAmG) [158.94.209.22]:60230: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:11:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:11:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-31 09:11:24 dovecot_login authenticator failed for H=(4C5E0C0DE7C6.mldns.ru) [109.72.235.193]:40891: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-31 09:11:27 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:44604: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-31 09:12:05 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:35134: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:12:19 dovecot_login authenticator failed for H=(updBMH) [158.94.209.22]:58580: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:12:04 dovecot_login authenticator failed for H=(gfQiN56u) [158.94.208.175]:63681: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:12:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: nobledec.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/nobledec/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:12:10 dovecot_login authenticator failed for H=(UVm8Zlhb) [92.118.39.145]:50430: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:12:19 dovecot_login authenticator failed for H=(fdlLRSV) [158.94.209.22]:58427: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.225.155.150
country_id: 953987
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/press.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:13:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:13:12 dovecot_login authenticator failed for H=(YbDZHtg) [92.118.39.145]:52634: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:13:13 dovecot_login authenticator failed for H=(9v769iAAB) [158.94.209.22]:53487: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: stillman.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/stillman/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:13:12 dovecot_login authenticator failed for H=(6OGA1ps) [158.94.208.175]:60700: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.60
country_id: 6252001
domain: stillman.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.146.78
country_id: 1835841
description:
2026-01-31 09:14:23 dovecot_login authenticator failed for H=([61.72.146.78]) [61.72.146.78]:44794: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:14:25 dovecot_login authenticator failed for H=(Lqw2WXna) [158.94.209.22]:59103: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:14:14 dovecot_login authenticator failed for H=(Wtz14A1Oe) [158.94.208.175]:56240: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-31 09:14:49 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:56484: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:14:07 dovecot_login authenticator failed for H=(FCEPyEW0nX) [158.94.209.22]:56223: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:14:19 dovecot_login authenticator failed for H=(XEvwNzuaPf) [92.118.39.145]:56026: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:14:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:15:19 dovecot_login authenticator failed for H=(qc3X6mr9m) [158.94.209.22]:60261: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:15:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:15:05 dovecot_login authenticator failed for H=(Cs2DStM1X) [92.118.39.145]:57803: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:15:20 dovecot_login authenticator failed for H=(gT3aujK) [158.94.208.175]:55836: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:16:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:16:15 dovecot_login authenticator failed for H=(HBKVnqbe) [92.118.39.145]:61003: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:16:31 dovecot_login authenticator failed for H=(BdXFlC3Y) [158.94.209.22]:53648: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:16:03 dovecot_login authenticator failed for H=(Ayou7Q5w) [158.94.208.175]:49376: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:16:13 dovecot_login authenticator failed for H=(oRnay2) [158.94.209.22]:58231: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 09:16:49 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:35498: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 09:17:04 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:13896: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:17:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:17:06 dovecot_login authenticator failed for H=(rFKhZ6C9) [158.94.208.175]:54316: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:17:07 dovecot_login authenticator failed for H=(CQlbP58) [158.94.209.22]:50308: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:17:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:17:23 dovecot_login authenticator failed for H=(qtGSXIPLB) [92.118.39.145]:63930: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: garudabay.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/garudabay/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:18:12 dovecot_login authenticator failed for H=(yjpQmJr02y) [158.94.208.175]:62428: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 09:18:13 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34671: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-01-31 09:18:39 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:39240: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:18:08 dovecot_login authenticator failed for H=(Mu5pka) [92.118.39.145]:49338: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 09:18:31 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:32798: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:18:37 dovecot_login authenticator failed for H=(wwfiK1UU) [158.94.209.22]:58600: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 09:19:00 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:51868: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:18:01 dovecot_login authenticator failed for H=(ji0Ya2YR) [158.94.209.22]:53257: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:18:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 09:18:27 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:50352: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:18:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 132.255.157.35
country_id: 3469034
domain: ajplantations.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:48219.ajplantations.com.my||ServerName:ajplantations.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cf221a97331997885dde29a4dd3d75ca14c8c3ce||Title:0x280e31e2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-31 09:18:37 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:54128: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:19:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 09:19:23 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:43332: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:19:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2026-01-31 09:19:59 dovecot_login authenticator failed for H=([154.144.255.209]) [154.144.255.209]:55050: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:19:18 dovecot_login authenticator failed for H=(ACPv8eA7) [158.94.208.175]:59308: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2026-01-31 09:19:43 dovecot_login authenticator failed for H=136.151.48.116.static.netvigator.com [116.48.151.136]:63549: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-01-31 09:19:59 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:58080: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:19:13 dovecot_login authenticator failed for H=(JuluKmUEN) [158.94.209.22]:63661: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:19:15 dovecot_login authenticator failed for H=(7EBQhvR) [92.118.39.145]:52203: 535 Incorrect authentication data (set_id=zurina@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:20:14 dovecot_login authenticator failed for H=(XtRwTrFQ66) [92.118.39.145]:54930: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 09:20:39 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:58607: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:20:02 dovecot_login authenticator failed for H=(e9h3cJcDn) [158.94.208.175]:59496: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:20:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:20:07 dovecot_login authenticator failed for H=(DZ5ZFbKdb) [158.94.209.22]:60256: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-31 09:20:10 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:39552: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:20:43 dovecot_login authenticator failed for H=(OhOiwHFuE) [158.94.209.22]:59694: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.181
country_id: 1668284
description:
2026-01-31 09:20:24 dovecot_login authenticator failed for H=111-70-49-181.emome-ip.hinet.net [111.70.49.181]:53517: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.34.244.50
country_id: 3703430
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85611515979972 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.69.22.152
country_id: 3469034
domain: ajresorts.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:64316.ajresorts.com.my||ServerName:ajresorts.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:686045b5de24ef352904fc9532c3b61ebbbb2628||Title:0xe0fb5a1e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:21:01 dovecot_login authenticator failed for H=(KKKuVgX7m4) [158.94.209.22]:50916: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 09:21:41 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:51332: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:21:14 dovecot_login authenticator failed for H=(8qgNigUCV) [158.94.208.175]:55495: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:21:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:21:22 dovecot_login authenticator failed for H=(sZ4Xiu1Be) [92.118.39.145]:57733: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:22:49 dovecot_login authenticator failed for H=(5NF2QenvbZ) [158.94.209.22]:54757: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-01-31 09:22:52 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:48690: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:22:08 dovecot_login authenticator failed for H=(x2UyqIjr) [92.118.39.145]:59536: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:22:13 dovecot_login authenticator failed for H=(yq64hlLc6c) [158.94.209.22]:58431: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 09:22:21 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:47676: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:22:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 09:22:25 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:35358: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 09:22:35 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:12747: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.244
country_id: 1819730
description:
2026-01-31 09:22:17 dovecot_login authenticator failed for H=(ADMIN) [86.107.104.244]:55502: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:22:10 dovecot_login authenticator failed for H=(FSW9ym) [158.94.208.175]:50429: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 09:22:12 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:62680: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 09:23:27 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:52666: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:23:06 dovecot_login authenticator failed for H=(qu0GOIPrD) [158.94.208.175]:56272: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:23:07 dovecot_login authenticator failed for H=(ka8Tp8742) [158.94.209.22]:57543: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-31 09:23:10 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:12994: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:23:17 dovecot_login authenticator failed for H=(73qJR4bc) [92.118.39.145]:62577: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:23:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:24:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:24:01 dovecot_login authenticator failed for H=(yOaZlofR6g) [158.94.209.22]:58331: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:24:02 dovecot_login authenticator failed for H=(lk0PKOEZ65) [92.118.39.145]:64437: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:24:06 dovecot_login authenticator failed for H=(gjzgRA) [77.83.39.64]:65421: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:24:09 dovecot_login authenticator failed for H=(HUL2eAoFA) [158.94.208.175]:56351: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:24:55 dovecot_login authenticator failed for H=(qyjxQYc) [158.94.209.22]:56254: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:25:15 dovecot_login authenticator failed for H=(V4xn57) [158.94.208.175]:64360: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:25:23 dovecot_login authenticator failed for H=(Fn6Im12oHk) [77.83.39.64]:57959: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:25:13 dovecot_login authenticator failed for H=(k29jrSRG) [158.94.209.22]:53388: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:25:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:25:10 dovecot_login authenticator failed for H=(Ga3A9f) [92.118.39.145]:51196: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:26:04 dovecot_login authenticator failed for H=(Fi8M5Gc) [77.83.39.64]:51262: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:26:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 09:26:12 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:13588: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 09:26:30 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:53476: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 09:26:42 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:45694: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:26:19 dovecot_login authenticator failed for H=(sl8RYvemp) [92.118.39.145]:54484: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:26:04 dovecot_login authenticator failed for H=(BxkSAtar) [158.94.208.175]:56180: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:26:07 dovecot_login authenticator failed for H=(ZFlansWQQC) [158.94.209.22]:53176: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:26:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: saps.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/sapscom/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:27:09 dovecot_login authenticator failed for H=(6Jn2lmGX) [158.94.208.175]:56194: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Jan 31 09:27:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zurina has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-01-31 09:27:04 dovecot_login authenticator failed for H=(TUXeDw45k) [92.118.39.145]:56357: 535 Incorrect authentication data (set_id=zurina)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:27:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:27:16 dovecot_login authenticator failed for H=(TJrbDguex) [77.83.39.64]:57469: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:27:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:27:01 dovecot_login authenticator failed for H=(D3pTmX4) [158.94.209.22]:64371: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-31 09:27:53 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:54381: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:27:01 dovecot_login authenticator failed for H=(5oL3gUV9) [158.94.209.22]:64278: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:28:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:28:05 dovecot_login authenticator failed for H=(kpvnfU2P) [77.83.39.64]:64286: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:28:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:28:13 dovecot_login authenticator failed for H=(tEJKmWPS) [158.94.209.22]:50283: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.149
country_id: 1668284
description:
2026-01-31 09:28:40 dovecot_login authenticator failed for H=110-25-112-149.adsl.fetnet.net [110.25.112.149]:46463: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-31 09:28:42 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:49331: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-31 09:28:50 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:47913: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 09:28:22 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:50431: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-01-31 09:28:24 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:48648: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-31 09:28:35 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:57901: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:28:02 dovecot_login authenticator failed for H=(4sSPcWZ) [158.94.208.175]:59399: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:29:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:29:07 dovecot_login authenticator failed for H=(6pndkPXf20) [158.94.209.22]:50327: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-31 09:29:25 dovecot_login authenticator failed for H=([122.187.230.66]) [122.187.230.66]:40682: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 09:29:49 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:38456: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:29:18 dovecot_login authenticator failed for H=(i6rZXfx) [158.94.208.175]:51723: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:29:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:29:20 dovecot_login authenticator failed for H=(d3RnJYrcX) [77.83.39.64]:58990: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2026-01-31 09:29:54 dovecot_login authenticator failed for H=([149.54.15.42]) [149.54.15.42]:35361: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:29:07 dovecot_login authenticator failed for H=(XLQVb32) [158.94.209.22]:50310: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-31 09:29:07 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:58312: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.63
country_id: 1668284
description:
2026-01-31 09:30:54 dovecot_login authenticator failed for H=110-25-109-63.adsl.fetnet.net [110.25.109.63]:44801: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/admin/upload/css.php||SC:/home/masaakisb/public_html/admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:30:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:30:11 dovecot_login authenticator failed for H=(rqOnDO) [77.83.39.64]:63740: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.73.51.218
country_id: 1814991
description:
2026-01-31 09:30:37 dovecot_login authenticator failed for H=([222.73.51.218]) [222.73.51.218]:59202: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:30:01 dovecot_login authenticator failed for H=(Y7MNbiCiyO) [158.94.209.22]:61885: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-31 09:30:06 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:32890: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:30:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:30:30 dovecot_login authenticator failed for H=(Ohr9NTR9) [158.94.208.175]:59887: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:31:05 dovecot_login authenticator failed for H=(AREMc7jP) [158.94.208.175]:60300: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:31:13 dovecot_login authenticator failed for H=(cKCcfqm) [158.94.209.22]:62371: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:31:13 dovecot_login authenticator failed for H=(cqRphO) [158.94.209.22]:62394: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:31:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/dynamichrcom/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.223.96.43
country_id: 2661886
domain: masaakisb.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/masaakisb/public_html/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:31:04 dovecot_login authenticator failed for H=(EPhRJ14VW) [77.83.39.64]:57841: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:32:07 dovecot_login authenticator failed for H=(ukLLBtT) [158.94.209.22]:56204: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 09:32:12 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:57602: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:32:17 dovecot_login authenticator failed for H=(c5TpAh) [77.83.39.64]:52711: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 09:32:23 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:52912: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:32:25 dovecot_login authenticator failed for H=(SRoEeiG4) [158.94.208.175]:63721: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.20.68
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.223.96.43
country_id: 2661886
domain: masaakisb.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/masaakisb/public_html/wp-includes/SimplePie/about.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-31 09:32:51 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:49354: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/masaakisb/public_html/wp-admin/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.197.222
country_id: 3175395
description:
2026-01-31 09:33:06 dovecot_plain authenticator failed for H=([100.127.255.249]) [217.138.197.222]:38355: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-01-31 09:33:18 dovecot_login authenticator failed for H=([118.220.149.121]) [118.220.149.121]:37770: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/masaakisb/public_html/wp-admin/images/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2026-01-31 09:33:05 dovecot_login authenticator failed for H=([178.178.194.151]) [178.178.194.151]:50990: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:33:06 dovecot_login authenticator failed for H=(K1Rxzhl) [77.83.39.64]:65184: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2026-01-31 09:33:43 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:50962: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.240
country_id: 2186224
description:
2026-01-31 09:33:53 dovecot_login authenticator failed for H=([121.73.168.240]) [121.73.168.240]:43384: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.2.140.186
country_id: 3469034
description:
2026-01-31 09:33:17 dovecot_login authenticator failed for H=(201-2-140-186.paemt704.e.brasiltelecom.net.br) [201.2.140.186]:34379: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:33:19 dovecot_login authenticator failed for H=(OHZYT68uVJ) [158.94.209.22]:52783: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 09:33:51 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:57474: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:33:01 dovecot_login authenticator failed for H=(jLjV4bQp) [158.94.209.22]:52552: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:33:26 dovecot_login authenticator failed for H=(G5m625) [158.94.208.175]:58336: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:33:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:34:13 dovecot_login authenticator failed for H=(ZzD5c2) [158.94.209.22]:52367: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-01-31 09:34:41 dovecot_login authenticator failed for H=([182.78.10.145]) [122.185.101.50]:60024: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350630
name: IM360 WAF: DB injection limit
abuser: 142.111.72.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: DB injection limit||ARG:ARGS:url||Injection:https://meet-wiki.win/index.php/From_Independence_to_Assistance:_How_Assisted_Living_and_In%E2%80%91Home_Care_Address_Memory_Care_Requirements||User:agsaintifik||SC:/home2/agsaintifik/public_html/wp-comments-post.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:34:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account teng has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.213
country_id: 6252001
description:
Jan 31 09:34:05 sv3 pure-ftpd[3950022]: (?@205.210.31.213) [INFO] New connection from 205.210.31.213


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 09:34:54 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:40329: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 09:34:06 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:52854: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:34:04 dovecot_login authenticator failed for H=(YIhNUaXwA) [158.94.208.175]:57449: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 09:34:17 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:33404: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:34:21 dovecot_login authenticator failed for H=(MlBun273x3) [77.83.39.64]:59691: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350576
name: IM360 WAF: DB injection block
abuser: 142.111.72.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: DB injection block||ARG:ARGS:url||Injection:https://meet-wiki.win/index.php/From_Independence_to_Assistance:_How_Assisted_Living_and_In%E2%80%91Home_Care_Address_Memory_Care_Requirements||User:agsaintifik||SC:/home2/agsaintifik/public_html/wp-comments-post.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:34:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-01-31 09:34:51 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:30784: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:35:10 dovecot_login authenticator failed for H=(aSdKPOIX4) [77.83.39.64]:62201: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 09:35:54 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:58950: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:35:25 dovecot_login authenticator failed for H=(3Nxbga27) [158.94.209.22]:56635: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:35:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account teng has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:35:05 dovecot_login authenticator failed for H=(Sh3aRQJ) [158.94.208.175]:51045: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:35:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:35:07 dovecot_login authenticator failed for H=(ulLQBRT4a) [158.94.209.22]:58772: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 09:35:15 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:57114: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-31 09:35:18 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:21840: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.202.81
country_id: 1733045
description:
2026-01-31 09:35:25 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.202.81]:15431: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-01-31 09:35:41 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:45435: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/font-awesome-5/css/fontawesome-all.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.198
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-300.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:36:24 dovecot_login authenticator failed for H=(THQxGwuh) [77.83.39.64]:62497: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.202.81
country_id: 1733045
description:
2026-01-31 09:36:04 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.202.81]:15461: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.173
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/revolution/css/navigation.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.235
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/themify-font/fonts/themify9f24.woff?-fvbane HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:36:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.193
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/revolution/css/layers.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.134
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.174
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.127.51
country_id: 1835841
description:
2026-01-31 09:36:49 dovecot_login authenticator failed for H=([218.157.127.51]) [218.157.127.51]:50454: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:36:11 dovecot_login authenticator failed for H=(muAK6m) [158.94.208.175]:60967: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:36:19 dovecot_login authenticator failed for H=(HW9a3h3) [158.94.209.22]:49301: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/revolution/css/settings.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:36:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account teng has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:36:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.181.18.213
country_id: 3996063
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.166
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/select2/select2.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
country_id: 1814991
description:
2026-01-31 09:37:00 dovecot_login authenticator failed for H=(ctw.webcas.net) [125.69.76.148]:39281: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/animsition/animsition.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:37:31 dovecot_login authenticator failed for H=(ntEPRk) [158.94.209.22]:57813: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2026-01-31 09:37:36 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:35690: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-31 09:37:57 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:47072: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:37:14 dovecot_login authenticator failed for H=(I6kciSUp) [158.94.208.175]:54104: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.202.81
country_id: 1733045
description:
2026-01-31 09:37:18 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.202.81]:15439: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:37:11 dovecot_login authenticator failed for H=(nquthXLl0) [77.83.39.64]:59626: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
country_id: 1835841
description:
2026-01-31 09:37:48 dovecot_login authenticator failed for H=([223.171.89.199]) [223.171.89.199]:50846: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-31 09:37:33 +0800] info [cpaneld] 202.178.120.157 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 09:37:35 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:49942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-01-31 09:37:39 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:58419: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 09:37:56 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:43626: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:37:13 dovecot_login authenticator failed for H=(mQBb3u2KN7) [158.94.209.22]:59863: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-31 09:37:19 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:55970: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:37:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:37:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:38:23 dovecot_login authenticator failed for H=(vBmRDH1) [77.83.39.64]:52805: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 43.165.190.5
country_id: 1861060
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/feliogroupcom/public_html/images/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/kendek/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:38:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:38:07 dovecot_login authenticator failed for H=(w7GxdEgTi) [158.94.209.22]:55706: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:38:13 dovecot_login authenticator failed for H=(ljg6jBGYJA) [158.94.208.175]:62816: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.202.81
country_id: 1733045
description:
2026-01-31 09:38:22 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.202.81]:15432: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: lnlfireprotection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/lnlfireprotectio/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-31 09:38:05 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:32836: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:38:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:39:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.202.81
country_id: 1733045
description:
2026-01-31 09:39:35 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.202.81]:15468: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:39:10 dovecot_login authenticator failed for H=(jfDjTDXs) [158.94.208.175]:51636: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:39:11 dovecot_login authenticator failed for H=(fUvZi8H) [77.83.39.64]:63107: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:39:37 dovecot_login authenticator failed for H=(PLdFFFfmV) [158.94.209.22]:52539: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:39:19 dovecot_login authenticator failed for H=(TwN9ag) [158.94.209.22]:62898: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.104.200.192
country_id: 1814991
description:
2026-01-31 09:40:18 dovecot_login authenticator failed for H=([14.104.200.192]) [14.104.200.192]:50602: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:40:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-01-31 09:40:23 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:58029: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-31 09:40:31 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:52264: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-01-31 09:40:04 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:58920: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:40:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:40:15 dovecot_login authenticator failed for H=(wttxEe1wA) [158.94.208.175]:56591: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 09:40:18 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:38603: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:40:23 dovecot_login authenticator failed for H=(tLp1fTaNp) [77.83.39.64]:57885: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-01-31 09:40:09 dovecot_login authenticator failed for H=([203.172.213.166]) [203.172.213.166]:33173: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:40:13 dovecot_login authenticator failed for H=(oK0GXKgVuH) [158.94.209.22]:62036: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/dosimeter.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:41:14 dovecot_login authenticator failed for H=(J8w0A2DV6N) [77.83.39.64]:49863: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:41:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:41:43 dovecot_login authenticator failed for H=(POCRavDsW) [158.94.209.22]:65464: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:41:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:41:13 dovecot_login authenticator failed for H=(9iMNWcUI) [158.94.208.175]:52530: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-31 09:41:54 +0800] info [cpaneld] 202.178.120.157 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:41:07 dovecot_login authenticator failed for H=(XqXePS1) [158.94.209.22]:52092: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:42:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-31 09:42:42 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.181.22]:48192: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:42:04 dovecot_login authenticator failed for H=(Kj9fXt) [77.83.39.64]:59808: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-01-31 09:42:08 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:40602: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:42:14 dovecot_login authenticator failed for H=(lZaGhlktM) [158.94.208.175]:64661: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:42:19 dovecot_login authenticator failed for H=(O9hos1h) [158.94.209.22]:63175: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 09:42:23 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:46000: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:42:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:43:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:43:39 dovecot_login authenticator failed for H=(9HYeuiQ) [158.94.208.175]:55327: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:43:13 dovecot_login authenticator failed for H=(qzVAOG) [158.94.209.22]:61056: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:43:16 dovecot_login authenticator failed for H=(4zKjTsp) [77.83.39.64]:58112: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:43:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:44:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:44:07 dovecot_login authenticator failed for H=(aFNaexCL) [158.94.209.22]:64316: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:44:25 dovecot_login authenticator failed for H=(PS22wW7lS9) [158.94.209.22]:55235: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:44:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:44:06 dovecot_login authenticator failed for H=(vXcvF2Z1) [77.83.39.64]:65474: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:44:09 dovecot_login authenticator failed for H=(r57t9UY) [158.94.208.175]:49654: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:45:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:45:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:45:08 dovecot_login authenticator failed for H=(AIEebV) [158.94.208.175]:50860: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:45:16 dovecot_login authenticator failed for H=(3xge1Ctc) [77.83.39.64]:58399: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:45:01 dovecot_login authenticator failed for H=(cf9650n) [158.94.209.22]:64872: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 09:45:20 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:49924: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-01-31 09:45:06 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:37066: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:46:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:46:08 dovecot_login authenticator failed for H=(tdU6Vg) [77.83.39.64]:62107: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 09:46:29 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:10410: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:46:21 dovecot_login authenticator failed for H=(JDjjdtW) [158.94.208.175]:52679: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:46:13 dovecot_login authenticator failed for H=(6AIEkABg) [158.94.209.22]:51104: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 09:46:19 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:56376: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 31 09:46:57 sv3 pure-ftpd[3959833]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 31 09:47:38 sv3 pure-ftpd[3960303]: (?@156.245.205.68) [WARNING] Authentication failed for user [langkawitravels]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 31 09:47:23 sv3 pure-ftpd[3960110]: (?@156.245.205.68) [WARNING] Authentication failed for user [test]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 09:47:18 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:48004: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:47:19 dovecot_login authenticator failed for H=(2GxolFP9Xg) [77.83.39.64]:56194: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:47:20 dovecot_login authenticator failed for H=(G6j1INYxy) [158.94.208.175]:57903: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.36
country_id: 2562770
description:
2026-01-31 09:47:04 dovecot_login authenticator failed for H=(ADMIN) [176.125.230.36]:22579: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.142.83
country_id: 1835841
description:
2026-01-31 09:47:06 dovecot_login authenticator failed for H=([106.245.142.83]) [106.245.142.83]:60811: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:47:07 dovecot_login authenticator failed for H=(4MJRHAXEQ) [158.94.209.22]:59141: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 31 09:47:27 sv3 pure-ftpd[3960198]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 31 09:47:00 sv3 pure-ftpd[3959833]: (?@156.245.205.68) [WARNING] Authentication failed for user [langkawitravels]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 31 09:47:00 sv3 pure-ftpd[3959857]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.161
country_id: 1733045
description:
2026-01-31 09:48:42 dovecot_login authenticator failed for H=([183.171.7.161]) [183.171.7.161]:52374: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:48:19 dovecot_login authenticator failed for H=(R1WO3h) [158.94.209.22]:59936: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.162
country_id: 1733045
description:
2026-01-31 09:48:57 dovecot_login authenticator failed for H=([183.171.7.162]) [183.171.7.162]:54568: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:48:09 dovecot_login authenticator failed for H=(TKDhz1) [77.83.39.64]:60828: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.207
country_id: 6252001
description:
2026-01-31  9:48:25 26284 [Warning] Aborted connection 26284 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.207' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.208
country_id: 1733045
description:
2026-01-31 09:48:44 dovecot_login authenticator failed for H=([49.124.149.208]) [49.124.149.208]:54942: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-01-31 09:48:19 dovecot_login authenticator failed for H=(223-197-145-141.static.imsbiz.com) [223.197.145.141]:56940: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:48:01 dovecot_login authenticator failed for H=(quLeQe6uS) [158.94.209.22]:49862: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:48:19 dovecot_login authenticator failed for H=(BZ1kdIxygU) [158.94.208.175]:65389: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2026-01-31 09:49:22 dovecot_login authenticator failed for H=([203.193.137.250]) [203.193.137.250]:64513: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.66.109.194
country_id: 932692
description:
2026-01-31 09:49:09 dovecot_login authenticator failed for H=([154.66.109.244]) [154.66.109.194]:55440: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-01-31 09:49:12 dovecot_login authenticator failed for H=([121.142.146.166]) [121.142.146.165]:44155: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:49:17 dovecot_login authenticator failed for H=(xGhOfl) [77.83.39.64]:50111: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-01-31 09:49:53 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:20160: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 09:49:30 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46839: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 09:49:48 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:41830: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 09:49:55 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:34412: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-31 09:50:00 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:37295: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-01-31 09:49:04 dovecot_login authenticator failed for H=([222.99.52.202]) [222.99.52.202]:37818: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 09:49:18 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:58012: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:49:19 dovecot_login authenticator failed for H=(bbK7SpVlyk) [158.94.208.175]:56001: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:49:13 dovecot_login authenticator failed for H=(hpso8MGaK4) [158.94.209.22]:55175: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:50:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:50:06 dovecot_login authenticator failed for H=(mQVKUwV0) [77.83.39.64]:56066: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 09:50:30 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:42548: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:50:47 dovecot_login authenticator failed for H=(YsBEaKZXy) [158.94.208.175]:62896: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:50:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:50:07 dovecot_login authenticator failed for H=(Pc9zMPG) [158.94.209.22]:56431: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:51:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:51:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:51:24 dovecot_login authenticator failed for H=(SNkxdBO) [77.83.39.64]:56824: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:51:16 dovecot_login authenticator failed for H=(AWbXwYCiRJ) [158.94.208.175]:59308: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: hmz.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/hmzcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:51:01 dovecot_login authenticator failed for H=(fgADKuSMN) [158.94.209.22]:56934: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:51:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:52:12 dovecot_login authenticator failed for H=(F2T9xngbp) [77.83.39.64]:61538: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 09:52:16 dovecot_login authenticator failed for H=(V8H4YOzF15) [158.94.208.175]:58481: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 09:52:54 dovecot_login authenticator failed for H=(uhTOjkOO) [158.94.208.110]:54776: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 09:52:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:52:13 dovecot_login authenticator failed for H=(jtjaZdJ4UG) [158.94.209.22]:52624: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:52:31 dovecot_login authenticator failed for H=(0XLOwCM) [158.94.209.22]:51639: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:52:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:53:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 09:53:18 dovecot_login authenticator failed for H=(ES7RptP) [158.94.208.110]:58604: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2026-01-31 09:53:59 dovecot_login authenticator failed for H=37-46-160-175.customers.ownit.se [37.46.160.175]:52946: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:53:01 dovecot_login authenticator failed for H=(S6isF47) [77.83.39.64]:64220: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-31 09:53:49 dovecot_login authenticator failed for H=(152-237-221-1.user.vtal.net.br) [187.40.215.162]:38172: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 09:53:48 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:40850: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:53:07 dovecot_login authenticator failed for H=(7v9D32Y5N) [158.94.209.22]:53127: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.74.68
country_id: 1668284
description:
2026-01-31 09:53:32 dovecot_login authenticator failed for H=221-120-74-68.emome-ip.hinet.net [221.120.74.68]:52304: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2026-01-31 09:54:12 dovecot_login authenticator failed for H=([103.219.154.156]) [103.219.154.156]:32776: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:54:16 dovecot_login authenticator failed for H=(WHn2AcLw) [77.83.39.64]:54019: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.112.87
country_id: 3374766
description:
2026-01-31 09:54:55 dovecot_login authenticator failed for H=(94.154.35.215) [165.90.112.87]:37165: 535 Incorrect authentication data (set_id=nurhayat@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:54:01 dovecot_login authenticator failed for H=(BZNTmkm) [158.94.209.22]:65358: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.47.35.35
country_id: 163843
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=23 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.214.160.4
country_id: 2017370
description:
2026-01-31 09:54:16 dovecot_login authenticator failed for H=(pool.luganet.ru) [178.214.160.4]:51512: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 09:54:19 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:58762: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-31 09:54:21 dovecot_login authenticator failed for H=([221.145.5.14]) [221.145.5.14]:60753: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 09:54:06 dovecot_login authenticator failed for H=(V3drRMKb4f) [158.94.208.110]:49797: 535 Incorrect authentication data (set_id=may)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.17.45
country_id: 6252001
description:
2026-01-31 09:54:34 dovecot_login authenticator failed for H=([72.250.17.45]) [72.250.17.45]:65279: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:55:13 dovecot_login authenticator failed for H=(kAl65EiTq) [158.94.209.22]:52718: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.153.76.247
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.208.5.108
country_id: 3625428
description:
2026-01-31 09:55:25 dovecot_login authenticator failed for H=(94.154.35.215) [201.208.5.108]:41716: 535 Incorrect authentication data (set_id=hadzrizan@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.3.29.42
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/exhibition.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 09:55:16 dovecot_login authenticator failed for H=(iTPwEL6EJe) [158.94.208.110]:61159: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:55:06 dovecot_login authenticator failed for H=(WQLpmqi) [77.83.39.64]:49357: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:56:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31  9:56:01 26556 [Warning] Aborted connection 26556 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:56:43 dovecot_login authenticator failed for H=(yUQGWR) [158.94.209.22]:54862: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 09:56:04 dovecot_login authenticator failed for H=(Jn5j88R06T) [158.94.208.110]:52504: 535 Incorrect authentication data (set_id=may)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:56:07 dovecot_login authenticator failed for H=(NlpF8P9) [158.94.209.22]:54590: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:56:17 dovecot_login authenticator failed for H=(fnniJq5) [77.83.39.64]:51858: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.236.118
country_id: 1733045
description:
2026-01-31 09:56:36 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.236.118]:60470: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:56:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:57:19 dovecot_login authenticator failed for H=(dzjFOEVoD) [158.94.209.22]:53758: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2026-01-31 09:57:36 dovecot_login authenticator failed for H=(213-91-179-26.btc-net.bg) [213.91.179.26]:49584: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:57:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.215.233.74
country_id: 1835841
description:
2026-01-31 09:57:18 dovecot_plain authenticator failed for H=(mf8yj7iwa5yfmllyw2p1) [1.215.233.74]:31538: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.236.118
country_id: 1733045
description:
2026-01-31 09:57:04 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.236.118]:60466: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 09:57:14 dovecot_login authenticator failed for H=(rmUTb8jd0E) [158.94.208.110]:63576: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:57:26 dovecot_login authenticator failed for H=(3btXQ7S) [77.83.39.64]:56203: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-01-31 09:57:51 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:34809: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:57:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-31 09:57:40 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:19084: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-31 09:57:49 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:51496: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 09:58:53 dovecot_login authenticator failed for H=(9Zyxd4zoKm) [69.5.189.21]:58893: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:58:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/iso.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:58:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:58:13 dovecot_login authenticator failed for H=(mKUbw8) [158.94.209.22]:65529: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:58:13 dovecot_login authenticator failed for H=(0e4UM2T) [77.83.39.64]:57335: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 09:58:02 dovecot_login authenticator failed for H=(sXaO0w) [158.94.208.110]:54968: 535 Incorrect authentication data (set_id=may)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.12.145.16
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=87 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 09:59:07 dovecot_login authenticator failed for H=(2Pd291U4) [158.94.209.22]:60559: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 09:59:17 dovecot_login authenticator failed for H=(FXxCOL) [69.5.189.21]:62766: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2026-01-31 09:59:26 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:34674: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-01-31 09:59:51 dovecot_login authenticator failed for H=([117.172.106.105]) [117.172.106.105]:36603: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 09:59:02 dovecot_login authenticator failed for H=(rJYAF64u) [77.83.39.64]:64440: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 09:59:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 09:59:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 10:00:04 dovecot_login authenticator failed for H=(QwHCIH4Ys9) [69.5.189.21]:54401: 535 Incorrect authentication data (set_id=may)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 10:00:04 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:52850: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 10:00:30 26710 [Warning] Aborted connection 26710 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.1
country_id: 1643084
domain: www.kendek.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:'-var_dump(md5(832265314))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:00:11 dovecot_login authenticator failed for H=(eE3GwRO) [77.83.39.64]:49919: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:00:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.1
country_id: 1643084
domain: www.kendek.com
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(561923745)||MVN:ARGS:id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:00:55 dovecot_login authenticator failed for H=(HgKweHpD3e) [158.94.209.22]:61101: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:00:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:00:19 dovecot_login authenticator failed for H=(5uEMM5) [158.94.209.22]:54703: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 10:00:27 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:33344: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.157.49.1
country_id: 1643084
domain: www.kendek.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/kendek/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:01:22 dovecot_login authenticator failed for H=(G3LKXsUVeq) [77.83.39.64]:61690: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:01:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:01:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:01:13 dovecot_login authenticator failed for H=(PumNP6) [158.94.209.22]:52539: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 10:01:13 dovecot_login authenticator failed for H=(s7GN8OQ) [69.5.189.21]:49710: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/sutsbcom/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:02:07 dovecot_login authenticator failed for H=(Oxwmxulik) [158.94.209.22]:61374: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 10:02:32 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:57590: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:02:10 dovecot_login authenticator failed for H=(8qOwv1) [77.83.39.64]:57157: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 10:02:46 dovecot_login authenticator failed for H=(K7uvRDU5) [69.5.189.21]:65115: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 10:02:54 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:55619: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 10:02:12 26812 [Warning] Aborted connection 26812 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-01-31 10:03:55 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:49412: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:03:02 dovecot_login authenticator failed for H=(q4EGsUS) [77.83.39.64]:59957: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2026-01-31 10:03:33 dovecot_login authenticator failed for H=([77.41.156.64]) [77.41.156.64]:60562: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:03:19 dovecot_login authenticator failed for H=(zXbY0xsbhH) [158.94.209.22]:61067: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 10:03:09 dovecot_login authenticator failed for H=(YHSm8Xp0) [69.5.189.21]:52663: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:04:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-31 10:05:00 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:50238: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:04:13 dovecot_login authenticator failed for H=(vgVIBD5kFM) [158.94.209.22]:51394: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:04:15 dovecot_login authenticator failed for H=(aequ68WANF) [77.83.39.64]:54767: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:05:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-01-31 10:06:00 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:52168: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:05:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 10:05:50 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:60289: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:05:25 dovecot_login authenticator failed for H=(ghOnUY) [158.94.209.22]:51876: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 10:05:23 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:10214: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-31 10:05:58 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:39745: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:05:07 dovecot_login authenticator failed for H=(TJ3HdT) [158.94.209.22]:50837: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:05:07 dovecot_login authenticator failed for H=(GPKbSFq) [77.83.39.64]:52102: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2026-01-31 10:05:47 dovecot_login authenticator failed for H=(213.142.48.143-fttb.planeta.tc) [213.142.48.143]:44477: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: account.visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/visoftcom/account.visoft.com.my/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:05:30 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-31 10:06:07 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:36850: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:06:19 dovecot_login authenticator failed for H=(6eNW1Aq) [158.94.209.22]:56963: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 10:06:20 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:10957: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:06:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:06:21 dovecot_login authenticator failed for H=(yC2zwzx8) [77.83.39.64]:58041: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:06:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:07:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:07:09 dovecot_login authenticator failed for H=(Iu2RwABfl) [77.83.39.64]:56790: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:07:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:07:13 dovecot_login authenticator failed for H=(Gq96tg2dR) [158.94.209.22]:62997: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/manfotp3/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 10:07:58 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:43894: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:08:17 dovecot_login authenticator failed for H=(qUBpFi) [77.83.39.64]:54000: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c5d75b065522d949ea4539c9483d405b4da33b8||Title:0x43c6d84c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:08:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:08:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:08:07 dovecot_login authenticator failed for H=(pJthXKxlV) [158.94.209.22]:55541: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 10:08:13 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:41516: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.165
country_id: 2328926
description:
2026-01-31 10:08:17 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.165]:26811: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.173.10
country_id: 1269750
description:
2026-01-31 10:08:44 dovecot_login authenticator failed for H=(nsg-corporate-105.246.185.122.airtel.in) [122.187.173.10]:33240: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.147.118.174
country_id: 2017370
description:
2026-01-31 10:08:31 dovecot_login authenticator failed for H=(174.118.147.82.ekb.enforta.com) [82.147.118.174]:50823: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:09:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:09:04 dovecot_login authenticator failed for H=(U4OLvMQ7H) [77.83.39.64]:50948: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:09:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:09:37 dovecot_login authenticator failed for H=(ShfWS8Pk) [158.94.209.22]:56255: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.206
country_id: 1269750
description:
2026-01-31 10:09:42 dovecot_login authenticator failed for H=([182.95.24.19]) [182.95.54.206]:52086: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:09:19 dovecot_login authenticator failed for H=(O7eM2mgmYd) [158.94.209.22]:61816: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2026-01-31 10:09:20 dovecot_login authenticator failed for H=(nhavuivn.com) [210.245.33.154]:62702: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 10:09:51 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59769: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:10:21 dovecot_login authenticator failed for H=(vk3oWNGmw9) [77.83.39.64]:57641: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-01-31 10:10:04 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:35108: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 10:10:11 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:47360: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 10:10:27 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:34340: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:95ffbb67289697fdd720c6700dbba28353e1a59a||Title:0xd0c4501d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:10:13 dovecot_login authenticator failed for H=(GWWKyVV2) [158.94.209.22]:56992: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:11:07 dovecot_login authenticator failed for H=(7JaQdeZVF7) [158.94.209.22]:59937: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4ff5d4f31482fc1896e9e27ab2881cabd6b1de2a||Title:0xf69e681c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:11:09 dovecot_login authenticator failed for H=(Arkfr4ym) [77.83.39.64]:60311: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 10:11:46 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:51028: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 10:11:58 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:52218: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:12:01 dovecot_login authenticator failed for H=(pe92pq7o) [158.94.209.22]:63792: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:12:23 dovecot_login authenticator failed for H=(YMtqo5QY1l) [77.83.39.64]:62030: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:12:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:366cdb6814c2aa5f05296d43124611616d7b28ec||Title:0x89a282fd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:13:45 dovecot_login authenticator failed for H=(m1hywBHoE) [178.16.54.138]:52107: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 10:13:46 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:57828: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:13:13 dovecot_login authenticator failed for H=(kkv5ltKk) [158.94.209.22]:61698: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 10:13:33 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:53960: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:13:12 dovecot_login authenticator failed for H=(8iXlCH) [77.83.39.64]:50999: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:13:31 dovecot_login authenticator failed for H=(u3wkOSuD) [158.94.209.22]:56714: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: modern.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/modern/public_html/images||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ef8fd739cc97d51136b8c80d876dfe299d2d6b2c||Title:0xde47e1b0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:13:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:14:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e9b356a21efa73a94088ee231874549bd3996c9||Title:0xf63f89c5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:14:03 dovecot_login authenticator failed for H=(wNDQaV) [77.83.39.64]:61393: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:14:07 dovecot_login authenticator failed for H=(blqciH) [158.94.209.22]:63507: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:14:13 dovecot_login authenticator failed for H=(ECZxfL) [178.16.54.138]:62619: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:14:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/indfinitydesign/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: urban.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/urban/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-31 10:14:45 dovecot_plain authenticator failed for H=(wantnes) [65.20.250.163]:48482: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 10:15:55 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:51797: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:15:01 dovecot_login authenticator failed for H=(2tYZe0xtT) [158.94.209.22]:49966: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:15:07 dovecot_login authenticator failed for H=(dziWXSQL7) [178.16.54.138]:59458: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:15:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 10:15:14 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:48329: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:15:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 10:15:23 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:47259: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-31 10:15:39 dovecot_login authenticator failed for H=(nsg-corporate-66.230.187.122.airtel.in) [122.187.230.66]:43288: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ea2bcbe90a8438a9e5d6af86e5ec07c9cd989db||Title:0xe9953cd7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:15:21 dovecot_login authenticator failed for H=(3KOMCn) [77.83.39.64]:53369: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 10:15:32 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:33142: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-31 10:16:07 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:50952: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:16:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:16:13 dovecot_login authenticator failed for H=(ERnvIf) [158.94.209.22]:65517: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c52263ecd05466ab036345651f47f2790ccbd875||Title:0xf52b7da9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:16:02 dovecot_login authenticator failed for H=(nO9immvkHj) [178.16.54.138]:59484: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:16:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:16:10 dovecot_login authenticator failed for H=(kARIVwND) [77.83.39.64]:49250: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:16:42 dovecot_login authenticator failed for H=(w6BsumBybc) [158.94.208.110]:56538: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:17:43 dovecot_login authenticator failed for H=(gFoj3fEV) [158.94.209.22]:62128: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:17:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.15.247.246
country_id: 2510769
description:
[2026-01-31 10:17:38 +0800] info [webmaild] 45.15.247.246 - central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:17:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:17:06 dovecot_login authenticator failed for H=(TQPzz3c) [158.94.208.110]:60454: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:17:07 dovecot_login authenticator failed for H=(siMs6Oj84Q) [158.94.209.22]:53157: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d2279b4c39b5d54fb977d278674cf23b5d1dd23||Title:0xca1ca7f5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 10:17:38 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:45246: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-31 10:17:03 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:54380: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:17:25 dovecot_login authenticator failed for H=(CMCx9CA) [178.16.54.138]:58016: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:17:21 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 10:17:22 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:49282: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:17:24 dovecot_login authenticator failed for H=(rFuIwpK) [77.83.39.64]:64547: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:18:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:18:16 dovecot_login authenticator failed for H=(sZb0OSFup) [178.16.54.138]:51691: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-01-31 10:18:38 dovecot_login authenticator failed for H=([112.45.66.28]) [117.172.106.105]:39618: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:18:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:18:01 dovecot_login authenticator failed for H=(XnkHbCvg) [158.94.209.22]:58435: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:18:15 dovecot_login authenticator failed for H=(h1RQ9tZs7G) [77.83.39.64]:51071: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:18:40 dovecot_login authenticator failed for H=(PRyuKh0e) [158.94.208.110]:59569: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa59ef1a86535237d8f4d24d7221dbe08e4a50d8||Title:0xd3cb15d0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:19:05 dovecot_login authenticator failed for H=(pWTTHWnU) [77.83.39.64]:57767: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:19:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 10:19:27 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:41744: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:19:09 dovecot_login authenticator failed for H=(mpUFejIBjw) [178.16.54.138]:57717: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:19:04 dovecot_login authenticator failed for H=(b5BQBLv) [158.94.208.110]:63420: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:19:13 dovecot_login authenticator failed for H=(ParHsCTa) [158.94.209.22]:55620: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 10:19:41 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:40338: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:236928ff767fb1ea0f6badfcf16856a3cc5e9873||Title:0x2caa5729||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:20:38 dovecot_login authenticator failed for H=(JV6udcgMS) [158.94.208.110]:62154: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:20:07 dovecot_login authenticator failed for H=(vlxSrv) [178.16.54.138]:61646: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:20:15 dovecot_login authenticator failed for H=(fIB2VksW3) [77.83.39.64]:49205: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.47.180
country_id: 6252001
description:
[2026-01-31 10:20:09 +0800] info [webmaild] 104.207.47.180 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:20:10 dovecot_login authenticator failed for H=(mPcDD441A) [158.94.209.22]:51167: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:20:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:20:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:21:04 dovecot_login authenticator failed for H=(DJFcsVDou) [158.94.209.22]:54469: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-31 10:21:06 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:44452: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:21:07 dovecot_login authenticator failed for H=(6jJkQiq) [77.83.39.64]:54566: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:21:22 dovecot_login authenticator failed for H=(cG8wuKay1H) [158.94.209.22]:64701: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:21:02 dovecot_login authenticator failed for H=(R5jLy5zeZR) [158.94.208.110]:49681: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:21:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 10:21:23 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:8387: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:21:02 dovecot_login authenticator failed for H=(o3Gkul) [178.16.54.138]:54484: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fcb4f2d1be656cd1ad80787a4ed7e9c5289ce4e||Title:0x8412cf93||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:21:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:22:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:22:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:22:25 dovecot_login authenticator failed for H=(ICZHVOfAKN) [77.83.39.64]:55621: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:22:37 dovecot_login authenticator failed for H=(Xfnjki6JE) [158.94.208.110]:65444: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-31 10:22:46 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:59156: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:22:16 dovecot_login authenticator failed for H=(1hq9fS) [158.94.209.22]:62211: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:22:17 dovecot_login authenticator failed for H=(cHoK34) [178.16.54.138]:54197: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-31 10:22:22 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:44106: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f359547e7d8d4fc9f57aeffb177787c51686b58||Title:0xb28bd85b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.42.171
country_id: 1835841
description:
2026-01-31 10:23:47 dovecot_login authenticator failed for H=([211.252.42.171]) [211.252.42.171]:38518: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:23:15 dovecot_login authenticator failed for H=(0vjDrRc2) [77.83.39.64]:62455: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:23:10 dovecot_login authenticator failed for H=(w300vVx) [158.94.209.22]:56258: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:23:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:23:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: chs.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/chscommy/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 10:24:00 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:55368: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:23:01 dovecot_login authenticator failed for H=(sU0XcMBzx) [158.94.208.110]:52965: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75c8bc790a1640c75ea11a5b5b6605a95d47388b||Title:0x5a7f7750||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:23:12 dovecot_login authenticator failed for H=(snOxPGhji9) [178.16.54.138]:54561: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:24:04 dovecot_login authenticator failed for H=(TZsb2K) [158.94.209.22]:61978: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:24:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9edaab3197583e1e496854d6d77fd9827cdf36bf||Title:0x9db3b183||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:24:08 dovecot_login authenticator failed for H=(mWvr8Hvi) [178.16.54.138]:49388: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:24:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:24:07 dovecot_login authenticator failed for H=(m2XYBTP8) [77.83.39.64]:54293: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-01-31 10:25:38 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:50062: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 10:25:48 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40210: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-31 10:25:57 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:51169: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:25:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:25:16 dovecot_login authenticator failed for H=(wT2m6K5o) [158.94.209.22]:56333: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 10:25:51 dovecot_login authenticator failed for H=(nsg-corporate-50.255.186.122.airtel.in) [122.186.255.50]:51792: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cd978017c402bb993d2310bcd01b07801eb398a||Title:0xd42ada7b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:25:24 dovecot_login authenticator failed for H=(qWTqtNpdMK) [77.83.39.64]:63346: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:25:27 dovecot_login authenticator failed for H=(60S3DlaX) [178.16.54.138]:59627: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:25:34 dovecot_login authenticator failed for H=(EIeviLL3XH) [158.94.209.22]:65410: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 10:25:36 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:43151: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.107.196.151
country_id: 2017370
description:
2026-01-31 10:25:41 dovecot_login authenticator failed for H=(ip-217.107.196.151.lipetsk.zelenaya.net) [217.107.196.151]:53778: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-31 10:25:52 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:34138: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
country_id: 1814991
description:
2026-01-31 10:25:27 dovecot_login authenticator failed for H=([171.217.70.151]) [171.217.70.151]:58604: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:26:18 dovecot_login authenticator failed for H=(ZO3I4tTMUQ) [178.16.54.138]:60063: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.197.207
country_id: 6252001
description:
2026-01-31 10:26:32 dovecot_plain authenticator failed for H=([10.18.18.187]) [37.19.197.207]:35002: 535 Incorrect authentication data (set_id=jessie@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:26:10 dovecot_login authenticator failed for H=(oXiv9rpB4) [158.94.209.22]:49639: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.200.240.65
country_id: 2017370
description:
2026-01-31 10:26:19 dovecot_plain authenticator failed for H=ismtj.co (tbteeylqvzopiztkfsanphc) [185.200.240.65]:46740: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:26:11 dovecot_login authenticator failed for H=(ZVTDDfm62) [77.83.39.64]:56399: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:26:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6eab53b0e3205a8dd318375fe9e05d402ea39545||Title:0x180fc7c9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.138.116.55
country_id: 2750405
description:
[2026-01-31 10:27:18 +0800] info [webmaild] 195.138.116.55 - prayerlink@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 10:27:52 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:11981: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:27:23 dovecot_login authenticator failed for H=(m9YGeYDlwz) [77.83.39.64]:49573: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:27:04 dovecot_login authenticator failed for H=(XldEAXg) [158.94.209.22]:59303: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.119.219
country_id: 6252001
description:
2026-01-31 10:27:10 dovecot_plain authenticator failed for H=([10.30.18.58]) [151.241.119.219]:5798: 535 Incorrect authentication data (set_id=jessie@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-01-31 10:27:41 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:45108: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:27:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:27:16 dovecot_login authenticator failed for H=(qtmpXmo) [178.16.54.138]:60678: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca844a301c7938808400563a02d09d4e663e3245||Title:0x749b2f72||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 10:28:04 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:45294: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:28:11 dovecot_login authenticator failed for H=(PMCrcZ) [77.83.39.64]:56200: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:29:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:28:08 dovecot_login authenticator failed for H=(WDIa6Liyn) [178.16.54.138]:54634: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:28:17 dovecot_login authenticator failed for H=(3uzrTf) [158.94.209.22]:55608: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:28:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.56
country_id: 6252001
domain: achieversvisionacademy.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.92 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d50bd9623d6daabba86692dbbb8c5d5d4e9a4b6d||Title:0x92df3c4f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:29:47 dovecot_login authenticator failed for H=(2KUeHMhh) [158.94.209.22]:53772: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:29:23 dovecot_login authenticator failed for H=(LWEyITLlZ) [77.83.39.64]:53747: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:093e2c8f306e44f2327b55fc2d6ceb5a2cb51dd4||Title:0x47061fd8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:29:11 dovecot_login authenticator failed for H=(Ld2beyK) [158.94.209.22]:58359: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.151.168
country_id: 6252001
description:
2026-01-31 10:29:47 dovecot_login authenticator failed for H=47-145-151-168.fdr01.blpk.ca.ip.frontiernet.net [47.145.151.168]:45250: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/osl.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 10:29:33 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:47044: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:29:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2026-01-31 10:29:54 dovecot_login authenticator failed for H=([178.178.222.50]) [178.178.222.50]:46088: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2026-01-31 10:29:58 dovecot_login authenticator failed for H=([59.22.68.213]) [59.22.68.213]:55200: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:29:03 dovecot_login authenticator failed for H=(6oDQkEg) [178.16.54.138]:61490: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49510ff090c0e78d5c2afd90635a34425d11f5d6||Title:0x609ed800||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:30:12 dovecot_login authenticator failed for H=(wSKWPgp6M) [77.83.39.64]:59827: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-01-31 10:30:27 dovecot_login authenticator failed for H=([125.62.129.188]) [59.145.160.134]:34780: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 10:30:59 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:54208: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:30:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:30:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2026-01-31 10:30:02 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:34335: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:30:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-01-31 10:30:05 dovecot_login authenticator failed for H=([203.252.10.4]) [203.252.10.4]:60352: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2026-01-31 10:30:52 dovecot_login authenticator failed for H=([183.171.7.171]) [183.171.7.171]:37978: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:30:23 dovecot_login authenticator failed for H=(FcZ09ZFn9f) [178.16.54.138]:56245: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.242
country_id: 798544
description:
2026-01-31 10:30:50 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.242]:4031: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:30:05 dovecot_login authenticator failed for H=(HpF6EH4) [158.94.209.22]:57870: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.54.74
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category=Primers Series&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:31:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:31:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:31:16 dovecot_login authenticator failed for H=(LdgZM9YU) [178.16.54.138]:61960: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:31:17 dovecot_login authenticator failed for H=(KDzwOrD3R6) [158.94.209.22]:51428: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:799f1e76eac2061bc15f578164c7b6b46dc17585||Title:0x79e223ab||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 35.87.112.248
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/blog/mon/particulier/loginform3ad6.php||SC:/home2/cabecom/public_html/img/blog||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:31:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:31:03 dovecot_login authenticator failed for H=(9F2203) [77.83.39.64]:58575: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79c8aa6f4d11dc2e429404aedf8d154fb80ac56a||Title:0xd75086ab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:32:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/lvconsultcom/public_html/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:32:11 dovecot_login authenticator failed for H=(E6FfgC0v) [158.94.209.22]:53415: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: u-net.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/unetcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-31 10:32:59 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:46828: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:32:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:32:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:32:15 dovecot_login authenticator failed for H=(f5Bj78EV) [77.83.39.64]:64834: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/admin/upload/css.php||SC:/home/lvconsultcom/public_html/admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:32:11 dovecot_login authenticator failed for H=(nrsLtxPKH) [178.16.54.138]:54637: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.155.146
country_id: 1814991
description:
2026-01-31 10:32:37 dovecot_login authenticator failed for H=([58.56.155.146]) [58.56.155.146]:34122: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1695c8c018f1a881d70c5aa552ce4ede0aaa8fc9||Title:0x5fd46a62||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.25.236.147
country_id: 2017370
description:
2026-01-31 10:33:20 dovecot_login authenticator failed for H=([217.25.236.147]) [217.25.236.147]:59680: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:33:03 dovecot_login authenticator failed for H=(s9Ja5JEx) [178.16.54.138]:52851: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2026-01-31 10:33:29 dovecot_login authenticator failed for H=([112.168.71.109]) [112.168.71.109]:52250: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:33:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/lvconsultcom/public_html/wp-admin/images/wp-login.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:33:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:33:05 dovecot_login authenticator failed for H=(hEpwlBGAhX) [158.94.209.22]:58221: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:33:04 dovecot_login authenticator failed for H=(NrQ3Ca) [77.83.39.64]:63191: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:33:59 dovecot_login authenticator failed for H=(YI84KEo) [158.94.209.22]:64339: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/lvconsultcom/public_html/wp-includes/SimplePie/about.php||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: symphony-led.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/symphonyadmin/public_html/wp-content||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.134.159.4
country_id: 1814991
description:
2026-01-31 10:34:24 28239 [Warning] Aborted connection 28239 to db: 'unconnected' user: 'unauthenticated' host: '8.134.159.4' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:34:15 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:34:17 dovecot_login authenticator failed for H=(ALzNDo) [158.94.209.22]:49965: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:34:23 dovecot_login authenticator failed for H=(7itYSiJ) [178.16.54.138]:63773: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-31 10:34:44 dovecot_login authenticator failed for H=(4C5E0C0DE7C6.mldns.ru) [109.72.235.193]:37836: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:34:16 dovecot_login authenticator failed for H=(zL7TlRVG5) [77.83.39.64]:54698: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.203.223
country_id: 298795
description:
2026-01-31 10:34:30 dovecot_login authenticator failed for H=([176.30.203.223]) [176.30.203.223]:60061: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 10:34:46 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:35676: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d9ee68ea238f7c630518d3c3663f980b9ba29a87||Title:0xb0711438||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:34:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:35:06 dovecot_login authenticator failed for H=(dTaUE3f1) [77.83.39.64]:60163: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:35:11 dovecot_login authenticator failed for H=(S6SUN9vBN) [158.94.209.22]:53605: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a3a8f8739b82c8d63514c9efd7420f8db0ad5a8c||Title:0xe354a173||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.237.152
country_id: 1814991
description:
2026-01-31 10:35:08 dovecot_login authenticator failed for H=(152.237.88.222.broad.ny.ha.dynamic.163data.com.cn) [222.88.237.152]:14778: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:35:17 dovecot_login authenticator failed for H=(Lvnmyg0I) [178.16.54.138]:55983: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:35:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:35:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6c50b988a79ff879a591aefcbd9ed79c2bf21c89||Title:0xed091188||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:36:19 dovecot_login authenticator failed for H=(TbiBDqAaG) [77.83.39.64]:58767: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2026-01-31 10:36:40 dovecot_login authenticator failed for H=([123.52.202.92]) [123.52.202.92]:33438: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:36:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:36:05 dovecot_login authenticator failed for H=(Pzpocr) [158.94.209.22]:58461: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:36:14 dovecot_login authenticator failed for H=(agVZv5urQ) [178.16.54.138]:51801: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-31 10:36:31 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:46506: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:18c47c41fbd9d2a6260ebc84eda0561401fd2a8d||Title:0x04aaa76a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:37:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:37:17 dovecot_login authenticator failed for H=(NgVleTuQh1) [158.94.209.22]:53353: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-31 10:37:24 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:50398: 535 Incorrect authentication data (set_id=jasonkua@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:37:08 dovecot_login authenticator failed for H=(9QgVslmgo) [178.16.54.138]:51698: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:37:08 dovecot_login authenticator failed for H=(NZKVNMVUB7) [77.83.39.64]:55914: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:38:29 dovecot_login authenticator failed for H=(qsSuJNmPh) [158.94.209.22]:58842: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:38:25 dovecot_login authenticator failed for H=(zM4yKQkN) [178.16.54.138]:62859: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-31 10:38:30 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (reeryoffs) [98.204.134.124]:45362: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:38:11 dovecot_login authenticator failed for H=(FkKN18o) [158.94.209.22]:51765: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:38:22 dovecot_login authenticator failed for H=(BSqCRdA1Um) [77.83.39.64]:57589: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:38:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53cce8328aee7b43d871f07a50a3768a986f3360||Title:0x354c31f3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:38:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 10:39:14 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:56014: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:39:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:39:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 10:39:07 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:54489: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:39:19 dovecot_login authenticator failed for H=(WBGvrF) [178.16.54.138]:56674: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 10:39:21 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:40434: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-31 10:39:37 dovecot_plain authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net (trugglyze) [81.42.225.40]:60186: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-31 10:39:39 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (pernes) [24.15.216.41]:50620: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:39:12 dovecot_login authenticator failed for H=(aTkJVSH) [77.83.39.64]:57470: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 10:39:31 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:43918: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:39:02 dovecot_login authenticator failed for H=(40InGO6n2n) [158.94.209.22]:61871: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22be558b9132cc49dbb1f26f2f2f693098268a51||Title:0xd40b1681||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:39:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-31 10:40:48 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:45968: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-31 10:40:08 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:59436: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:40:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.42.124.117
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.69.219
country_id: 6252001
description:
2026-01-31 10:40:17 dovecot_login authenticator failed for H=([209.23.69.219]) [209.23.69.219]:46328: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:40:17 dovecot_login authenticator failed for H=(RFJY5W0B) [158.94.209.22]:55613: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:40:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:40:04 dovecot_login authenticator failed for H=(jiKOF0B) [77.83.39.64]:51854: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8466e04d79f2eab53029128c38417161ef1054a4||Title:0x2e53ec9a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:40:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:40:10 dovecot_login authenticator failed for H=(92Bekzm) [178.16.54.138]:62343: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.207.232.72
country_id: 1269750
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:40:35 dovecot_login authenticator failed for H=(VWs2wrY) [158.94.209.22]:53857: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 10:40:57 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:58344: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e18d905a083c9a2f4cef5030d4acf62378fc909||Title:0x71df0fce||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:41:11 dovecot_login authenticator failed for H=(9911KCEj0F) [158.94.209.22]:61385: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:41:19 dovecot_login authenticator failed for H=(v5816aogL) [77.83.39.64]:60358: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-31 10:41:20 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:55172: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:41:14 dovecot_login authenticator failed for H=(j8vaCPYS) [178.16.54.138]:53356: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:41:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:41:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.253.209
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57011528707507 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.63.186
country_id: 1835841
description:
2026-01-31 10:41:01 dovecot_login authenticator failed for H=([121.66.63.186]) [121.66.63.186]:40911: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 10:41:12 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:50527: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:41:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-31 10:41:47 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:47610: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.223.1.182
country_id: 2017370
description:
2026-01-31 10:42:02 dovecot_login authenticator failed for H=(89-223-1-182.obit.ru) [89.223.1.182]:46329: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:42:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:42:05 dovecot_login authenticator failed for H=(0yP5PTQ) [158.94.209.22]:49701: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:42:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 10:42:46 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:33672: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f6e94ff9e4d129731659cfb495c03e2477318f0d||Title:0x77546d94||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:42:10 dovecot_login authenticator failed for H=(u3qTcq6WU) [77.83.39.64]:64045: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:42:29 dovecot_login authenticator failed for H=(h8aGOu5UC) [158.94.209.22]:51534: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:42:05 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:42:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:42:09 dovecot_login authenticator failed for H=(G70iPbCyi) [178.16.54.138]:64678: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 10:42:43 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:52370: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:43:37 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 10:43:05 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:49402: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:43:26 dovecot_login authenticator failed for H=(9z3dKTYU) [178.16.54.138]:55015: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:43:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9db505bb8cc29bf3944790f6382cb14cc65a97e6||Title:0x90a3f61c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:43:06 dovecot_login authenticator failed for H=(yfviBm3M8i) [158.94.209.22]:49479: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 10:43:58 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:38167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:43:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:43:23 dovecot_login authenticator failed for H=(XpiyyR) [77.83.39.64]:62099: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 10:44:41 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:49550: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:44:24 dovecot_login authenticator failed for H=(2A5I7pXpd) [178.16.54.138]:59965: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:44:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cddacd3b5312227d77d10d558ea1d667ad7046b9||Title:0xde292492||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:44:03 dovecot_login authenticator failed for H=(DwnrPVxf) [158.94.209.22]:62118: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:44:13 dovecot_login authenticator failed for H=(t6wMuYQmz) [77.83.39.64]:56941: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:44:21 dovecot_login authenticator failed for H=(bALIbXg2TD) [158.94.209.22]:55766: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:45:17 dovecot_login authenticator failed for H=(KB4FStdj2A) [178.16.54.138]:59300: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:45:11 dovecot_login authenticator failed for H=(fMcYOx) [77.83.39.64]:55483: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:45:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-31 10:45:50 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:51458: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4df6633f06aa02e10385b718bae13205186b7454||Title:0xa57c0229||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-01-31 10:45:12 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:33712: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.101
country_id: 6252001
description:
2026-01-31 10:45:41 dovecot_login authenticator failed for H=wsip-184-186-104-101.lv.lv.cox.net [184.186.104.101]:59995: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 31 10:45:40 sv3 sshd[4011230]: Accepted publickey for root from 10.1.14.100 port 51702 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:45:15 dovecot_login authenticator failed for H=(Sl2T8g5jH) [158.94.209.22]:65357: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:46:13 dovecot_login authenticator failed for H=(QRFFrLF) [178.16.54.138]:55567: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:46:15 dovecot_login authenticator failed for H=(Xj21Tc7) [158.94.209.22]:53150: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:46:20 dovecot_login authenticator failed for H=(aVeu6Qy) [77.83.39.64]:62406: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31 10:46:23 28784 [Warning] Aborted connection 28784 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03e51b31ad4e3b6111e9359d62121408ac2101da||Title:0x9d807ada||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 10:46:07 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:48373: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:46:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-01-31 10:46:30 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:34144: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:47:45 dovecot_login authenticator failed for H=(uHhCmkebJ) [158.94.209.22]:53423: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: dsc-expat.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/dscexpat/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:47:34 dovecot_login authenticator failed for H=(fwQgK50i) [178.16.54.138]:53364: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-01-31 10:47:45 dovecot_login authenticator failed for H=([196.191.212.226]) [213.55.85.204]:7293: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/medinovacom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:47:09 dovecot_login authenticator failed for H=(99Aw1E) [158.94.209.22]:59625: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 10:47:30 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:51304: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.242.64.111
country_id: 1814991
description:
2026-01-31 10:47:54 dovecot_login authenticator failed for H=([183.242.64.111]) [183.242.64.111]:51777: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:47:15 dovecot_login authenticator failed for H=(H5p1EfgR4O) [77.83.39.64]:51491: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74d8c9c914dfd0f9eae2c606c528f502d7948e85||Title:0x60c0dddc||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:48:47 dovecot_login authenticator failed for H=(NUrkO8n) [178.16.54.138]:58138: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:48:03 dovecot_login authenticator failed for H=(QiDULXAQS) [158.94.209.22]:51160: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:48:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:48:09 dovecot_login authenticator failed for H=(RvmGNRL7) [77.83.39.64]:57356: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-31 10:48:46 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:55372: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.150
country_id: 1269750
description:
2026-01-31 10:48:02 dovecot_login authenticator failed for H=(nsg-corporate-150.230.187.122.airtel.in) [122.187.230.150]:34907: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:48:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
country_id: 1835841
description:
2026-01-31 10:48:35 dovecot_login authenticator failed for H=([210.97.109.192]) [210.97.109.192]:58375: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:82cdd84cb2da48400f16d91b4158c3eb0a7f9a3f||Title:0x65847d26||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:49:18 dovecot_login authenticator failed for H=(N3Elf3S82) [158.94.209.22]:60254: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:49:19 dovecot_login authenticator failed for H=(I5tlVNQjjH) [77.83.39.64]:50071: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:49:13 dovecot_login authenticator failed for H=(EHPdi0G) [178.16.54.138]:51720: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:49:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:49:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:49:41 dovecot_login authenticator failed for H=(dd4GC3Xy) [178.16.54.22]:65268: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b6045f8e31da002217905d571df4b6964f8d6ec||Title:0x54edb0a1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:50:08 dovecot_login authenticator failed for H=(x5xG2ADwNK) [178.16.54.138]:52832: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:50:10 dovecot_login authenticator failed for H=(fRkc46ztJ) [77.83.39.64]:53510: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.240
country_id: 798544
description:
2026-01-31 10:50:51 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.240]:62099: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2930dc158cb29037795cb04dc9550ccad4f498cc||Title:0x0ac8095b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:50:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:50:12 dovecot_login authenticator failed for H=(1cugji) [158.94.209.22]:62484: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:50:13 dovecot_login authenticator failed for H=(jiizQ8) [178.16.54.22]:62437: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:50:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:50:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-31 10:50:24 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:58568: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-31 10:50:33 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:36868: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2026-01-31 10:51:13 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:53509: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:51:24 dovecot_login authenticator failed for H=(xWDuHqPpV2) [158.94.209.22]:53279: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-31 10:51:27 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:39599: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:51:11 dovecot_login authenticator failed for H=(mJosNKN) [178.16.54.22]:53865: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:51:01 dovecot_login authenticator failed for H=(IkA5DzFRRd) [178.16.54.138]:62393: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dff36a6db53c2967769d4a57ab5004e7b9bf905a||Title:0xcba1ff2e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:51:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:51:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:51:06 dovecot_login authenticator failed for H=(0pNCD90l) [158.94.209.22]:62373: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:52:24 dovecot_login authenticator failed for H=(4miwqiLF) [178.16.54.138]:54023: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.198.68.233
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/Loader/JsonFileLoaderTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 10:52:14 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:38650: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:52:18 dovecot_login authenticator failed for H=(b8EUmGW57) [158.94.209.22]:62599: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:52:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:52:30 dovecot_login authenticator failed for H=(SmJs4OL7SW) [178.16.54.22]:54928: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 185.220.101.8
country_id: 2921044
domain: ms-chemicals.net
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:52:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.234.61.160
country_id: 6252001
description:
2026-01-31 10:52:52 dovecot_login authenticator failed for H=c-71-234-61-160.hsd1.ct.comcast.net ([127.0.0.1]) [71.234.61.160]:35046: 535 Incorrect authentication data (set_id=info@vc-b.com)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 185.220.101.8
country_id: 2921044
domain: ms-chemicals.net
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:53:16 dovecot_login authenticator failed for H=(GqPhYTJzm) [178.16.54.138]:60890: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d0d1984e08269c2b570ab4cc02141cdcded34d2||Title:0x7cb1de4a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:53:06 dovecot_login authenticator failed for H=(eqiiIiKR) [178.16.54.22]:60221: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:53:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:53:12 dovecot_login authenticator failed for H=(2Ko7mpzrX) [158.94.209.22]:55655: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:54:05 dovecot_login authenticator failed for H=(Z4j9yR1utK) [178.16.54.22]:63851: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:54:10 dovecot_login authenticator failed for H=(iKcN1rcgEP) [178.16.54.138]:61585: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:54:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31 10:54:56 29336 [Warning] Aborted connection 29336 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 45.134.225.36
country_id: 2921044
domain: vtgroupsb.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.169 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.49
country_id: 2017370
description:
2026-01-31 10:54:24 dovecot_login authenticator failed for H=([178.178.222.49]) [178.178.222.49]:36254: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8706b0d356a650ef19596d6fb8a9458dd17a701||Title:0x0835fd55||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:54:06 dovecot_login authenticator failed for H=(MGApeUaX) [158.94.209.22]:56312: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2026-01-31 10:54:38 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:39861: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a683d77f344929a0caf4225ffb4d22fad08e96e||Title:0x979aba2e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:55:18 dovecot_login authenticator failed for H=(gCc8gcnhw) [158.94.209.22]:54417: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:55:36 dovecot_login authenticator failed for H=(Zgp9jM) [158.94.209.22]:50184: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: garudabay.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/garudabay/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:55:05 dovecot_login authenticator failed for H=(BJXHXG) [178.16.54.138]:59249: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:55:13 dovecot_login authenticator failed for H=(cpqmPFx) [178.16.54.22]:64800: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31 10:56:10 29378 [Warning] Aborted connection 29378 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:56:12 dovecot_login authenticator failed for H=(1LqkWJ5) [158.94.209.22]:59288: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 10:56:41 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:55624: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:56:22 dovecot_login authenticator failed for H=(Wi4PXW) [178.16.54.22]:59955: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-31 10:56:33 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:54997: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 10:56:52 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:36912: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-01-31 10:57:20 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:54029: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80a668553230cf400b8609aaf5e42dc0021bf508||Title:0xedfe0107||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:57:10 dovecot_login authenticator failed for H=(Hlfnd0Qh0w) [178.16.54.22]:64575: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:57:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:57:06 dovecot_login authenticator failed for H=(Xv7rpp01q) [158.94.209.22]:60379: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/agpcorg/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 10:57:46 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:40425: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.232.114.71
country_id: 3469034
description:
2026-01-31 10:58:57 dovecot_login authenticator failed for H=(189-108-96-183.customer.tdatabrasil.net.br) [200.232.114.71]:43618: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:58:19 dovecot_login authenticator failed for H=(VA18aowkMy) [158.94.209.22]:55599: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-31 10:58:20 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:49954: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 10:58:49 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53010: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 10:58:05 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13053: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:58:22 dovecot_login authenticator failed for H=(YDEBAYq) [178.16.54.22]:65282: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2026-01-31 10:58:13 dovecot_login authenticator failed for H=(213.142.48.143-fttb.planeta.tc) [213.142.48.143]:53481: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:58:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 10:58:27 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:22308: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:59:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2026-01-31 10:59:13 dovecot_login authenticator failed for H=201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:36918: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:59:13 dovecot_login authenticator failed for H=(faIErNlI) [178.16.54.22]:58815: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:59:31 dovecot_login authenticator failed for H=(gIDgR7mvNT) [158.94.209.22]:65285: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:59:13 dovecot_login authenticator failed for H=(mnaDIlgj) [158.94.209.22]:57285: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b533131e85bbe827754614569d8ec6f7265e53b||Title:0x3347e206||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31 10:59:40 29536 [Warning] Aborted connection 29536 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7c2b86334d3f04d1d5688bd01025a6b1518f855||Title:0x93a238ab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:00:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 11:00:21 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:52752: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 11:00:35 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:51384: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:00:42 dovecot_login authenticator failed for H=(Y7RIcWB) [178.16.54.22]:50248: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:00:07 dovecot_login authenticator failed for H=(tPuOSr8aAE) [158.94.209.22]:60367: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:01:59 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:44234: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:01:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:01:19 dovecot_login authenticator failed for H=(2jQym4xt) [158.94.209.22]:62289: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-01-31 11:01:21 29590 [Warning] Aborted connection 29590 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:01:23 dovecot_login authenticator failed for H=(65umVOx) [178.16.54.22]:61839: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 11:01:49 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:59852: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c354c715d080762e03af11fdc7c12b913338bc4||Title:0xde845e59||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:02:13 dovecot_login authenticator failed for H=(6onK8R9R3) [158.94.209.22]:50845: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/solidfencecom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 11:02:11 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:49858: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:02:21 dovecot_login authenticator failed for H=(aUDr9Vu9Z) [178.16.54.22]:56894: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
country_id: 1814991
description:
2026-01-31 11:02:40 dovecot_login authenticator failed for H=(119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:35500: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: langkawiconstructions.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/lkwconstructions/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 11:02:55 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:55062: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: langkawiconstructions.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home2/lkwconstructions/public_html/wp-content/uploads/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.121.206
country_id: 1733045
description:
[2026-01-31 11:03:31 +0800] info [webmaild] 113.211.121.206 - felicia@nexuscollection.com "POST /cpsess2582928648/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.133.31] != Current IP Address [113.211.121.206]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.131.13.235
country_id: 3175395
description:
2026-01-31 11:03:38 dovecot_plain authenticator failed for H=vps-2ad1c31b.vps.ovh.net (WIN-V2L96PKQFU1.openstacklocal) [57.131.13.235]:53581: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.112.45
country_id: 1269750
description:
2026-01-31 11:03:04 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.112.45]:50796: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:03:43 dovecot_login authenticator failed for H=(WNWwRaNLF) [158.94.209.22]:56698: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a226fe1f84b2da6b0544df2620762cd53fa5066||Title:0x00ce54bc||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-31 11:03:49 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:41156: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:03:07 dovecot_login authenticator failed for H=(XOQru5Y7n) [178.16.54.22]:61586: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:03:07 dovecot_login authenticator failed for H=(JClsCd2pn) [158.94.209.22]:63909: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-31 11:03:23 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:30120: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.39.221
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/egulias/email-validator/EmailValidator/EmailParser.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2026-01-31 11:03:51 dovecot_login authenticator failed for H=(2-55-125-200.orange.net.il) [2.55.125.200]:36126: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.16.103.46
country_id: 2017370
description:
2026-01-31 11:04:14 dovecot_login authenticator failed for H=([62.16.103.46]) [62.16.103.46]:53681: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-31 11:04:44 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:59872: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-01-31 11:04:15 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:48304: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.176.136
country_id: 2139685
description:
2026-01-31 11:04:31 dovecot_login authenticator failed for H=host-202-166-176-136.static.lagoon.nc [202.166.176.136]:32890: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:04:01 dovecot_login authenticator failed for H=(R1KktTB8) [158.94.209.22]:54224: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/visoftcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 11:04:10 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54876: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:04:13 dovecot_login authenticator failed for H=(8R3r6vzH) [178.16.54.22]:56365: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.4.15.134
country_id: 3469034
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=4724 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:05:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b4a2e22ce80f4dad635a8b7364a97497f78b2c4||Title:0xab5f8a54||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:05:13 dovecot_login authenticator failed for H=(f0Glnq8) [158.94.209.22]:57274: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.131.13.235
country_id: 3175395
description:
2026-01-31 11:05:58 dovecot_plain authenticator failed for H=vps-2ad1c31b.vps.ovh.net (WIN-V2L96PKQFU1.openstacklocal) [57.131.13.235]:53972: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:05:17 dovecot_login authenticator failed for H=(zhuwlmj94) [178.16.54.138]:60276: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:05:22 dovecot_login authenticator failed for H=(vOlhd65OW5) [178.16.54.22]:59354: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-01-31 11:06:14 29743 [Warning] Aborted connection 29743 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d7a9f24766d2a4117e3316e0cdb17e8ddb9af20||Title:0xdeff53f6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.131.13.235
country_id: 3175395
description:
2026-01-31 11:06:04 dovecot_login authenticator failed for H=vps-2ad1c31b.vps.ovh.net (WIN-V2L96PKQFU1.openstacklocal) [57.131.13.235]:53972: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:06:07 dovecot_login authenticator failed for H=(WzTH6PPuye) [158.94.209.22]:51739: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:06:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:06:09 dovecot_login authenticator failed for H=(F7O7lj) [178.16.54.138]:57339: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


