# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 17:30:08 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59750: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 17:30:39 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:56708: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.7
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/blkid/blkid.tab.old||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:31:03 dovecot_login authenticator failed for H=(9C5P5Xj) [178.16.54.22]:61174: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-01-31 17:31:08 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:60202: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 17:31:20 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:38387: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 17:31:01 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:53473: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-01-31 17:32:35 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:60708: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:32:14 H=([167.148.167.71]) [167.148.167.71]:54840 F=<Support@u-net.com.my> rejected RCPT <eddy@u-net.com.my>: SPF: 167.148.167.71 is not allowed to send mail from u-net.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:32:15 dovecot_login authenticator failed for H=(XdpVWj) [178.16.54.22]:63855: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 17:32:22 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:47632: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 17:32:12 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:53718: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 17:33:28 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:45492: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 17:33:45 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:28007: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-01-31 17:33:47 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:46024: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:33:24 dovecot_login authenticator failed for H=(Gf0xLaezuC) [178.16.54.22]:58797: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-31 17:34:02 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:54070: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:34:10 dovecot_login authenticator failed for H=(yjyKID) [178.16.54.22]:57678: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
country_id: 1814991
description:
2026-01-31 17:34:13 dovecot_login authenticator failed for H=([116.132.42.170]) [116.132.42.170]:56092: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:35:07 dovecot_login authenticator failed for H=(kRanKkz) [178.16.54.22]:54254: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.113.138
country_id: 1814991
description:
2026-01-31 17:35:13 dovecot_login authenticator failed for H=([27.115.113.138]) [27.115.113.138]:32836: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2026-01-31 17:35:14 dovecot_login authenticator failed for H=([1.235.192.130]) [1.235.192.130]:41027: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-31 17:35:25 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:54178: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 17:35:04 dovecot_login authenticator failed for H=([42.1.110.201]) [42.1.110.201]:60178: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:36:59 H=([167.148.167.71]) [167.148.167.71]:52729 F=<Support@tujusetia.my> rejected RCPT <engkong.wee@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:36:21 dovecot_login authenticator failed for H=(81ekqLYDNq) [178.16.54.22]:58819: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-31 17:37:05 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.181.22]:48630: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-31 17:37:13 dovecot_login authenticator failed for H=([182.95.227.70]) [182.95.227.70]:39886: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:38:52 dovecot_login authenticator failed for H=(WMCfqFm6uT) [178.16.54.22]:53930: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 17:38:59 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:47302: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2026-01-31 17:39:25 dovecot_login authenticator failed for H=([49.124.152.172]) [49.124.152.172]:57664: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:39:28 dovecot_login authenticator failed for H=(3X2UMTfg) [185.169.4.188]:50324: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-01-31 17:39:31 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:33842: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-31 17:39:40 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:60674: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:39:27 dovecot_login authenticator failed for H=(Z0nkz8re) [178.16.54.22]:61228: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 17:39:30 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:43656: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-31 17:40:00 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:58902: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.42.171
country_id: 1835841
description:
2026-01-31 17:39:09 dovecot_login authenticator failed for H=([211.252.42.171]) [211.252.42.171]:60654: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 17:40:52 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:55898: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:40:02 dovecot_login authenticator failed for H=(GQXYRb) [185.169.4.188]:56538: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.35.156.26
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/3249053632.jpg&size=1000x1000 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 17:40:37 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:1126: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:40:58 dovecot_login authenticator failed for H=(mNjM0OnjH) [178.16.54.22]:55117: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.177.166
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:41:29 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57595: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:41:19 dovecot_login authenticator failed for H=(wsXoJ65L) [185.169.4.188]:56494: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:41:40 dovecot_login authenticator failed for H=(qxVqwSIL9e) [178.16.54.22]:60664: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-31 17:41:47 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:45109: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.100.250.41
country_id: 2017370
description:
2026-01-31 17:42:45 dovecot_login authenticator failed for H=(93.100.250.41.pool.sknt.ru) [93.100.250.41]:51490: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 17:42:05 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:49397: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:42:23 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64745: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:42:11 dovecot_login authenticator failed for H=(k8mf6K6TeO) [185.169.4.188]:52529: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:42:24 dovecot_login authenticator failed for H=(LnHTi7h0F) [178.16.54.22]:51250: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 17:42:22 H=([45.144.212.50]) [45.144.212.50]:62249 F=<ccmsservice@bangkokbank.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:43:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:43:03 dovecot_login authenticator failed for H=(Mirt9yWI) [185.169.4.188]:65368: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-31 17:43:05 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:63055: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:43:31 dovecot_login authenticator failed for H=(35qjsamzdb) [178.16.54.22]:59832: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2026-01-31 17:43:58 dovecot_login authenticator failed for H=([218.25.233.2]) [218.25.233.22]:35165: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.229
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/31docproperties.xls HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.29
country_id: 3703430
description:
2026-01-31 17:43:18 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.29]:56370: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/krisfood/public_html/images/class.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:44:03 dovecot_login authenticator failed for H=(FfIANJazx) [178.16.54.22]:55937: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:44:18 dovecot_login authenticator failed for H=(yUt4hsBX) [185.169.4.188]:51828: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:44:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 17:44:21 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:35310: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 17:44:46 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:41288: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.48.93.218
country_id: 1814991
description:
2026-01-31 17:44:10 dovecot_login authenticator failed for H=(218.93.48.59.broad.jz.sx.dynamic.163data.com.cn) [59.48.93.218]:47190: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 17:45:01 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:46165: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-31 17:44:39 dovecot_login authenticator failed for H=([36.135.62.102]) [36.135.62.103]:43026: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.78.152.240
country_id: 1861060
domain: ajresorts.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/ajresortscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:45:12 dovecot_login authenticator failed for H=(p2m1gk) [185.169.4.188]:65328: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:45:12 H=([167.148.167.71]) [167.148.167.71]:55784 F=<Support@euratech.com.my> rejected RCPT <euratech@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 17:45:13 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:37968: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/ajresortscom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 17:45:02 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:49302: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:45:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:45:27 dovecot_login authenticator failed for H=(fKa6jM2ZO) [178.16.54.22]:56484: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:46:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:46:04 dovecot_login authenticator failed for H=(zOIUmpN9P) [185.169.4.188]:54036: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:46:31 dovecot_login authenticator failed for H=(AaItBLx) [178.16.54.22]:56201: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 17:47:46 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:50087: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:47:02 dovecot_login authenticator failed for H=(69L0WGTSd) [178.16.54.22]:49766: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 17:47:02 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:59936: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:47:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:47:22 dovecot_login authenticator failed for H=(qgVLix8l8z) [185.169.4.188]:62848: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-01-31 17:47:33 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:47327: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:48:09 dovecot_login authenticator failed for H=(HBZUhdhfU) [178.16.54.22]:49699: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-31 17:48:12 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:56644: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:48:17 dovecot_login authenticator failed for H=(lnOAo6u5) [185.169.4.188]:49681: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:49:01 dovecot_login authenticator failed for H=(3pxFqXw2) [185.230.124.69]:54000: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: lnlfireprotection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/lnlfireprotectio/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:49:09 dovecot_login authenticator failed for H=(7FTRosA) [185.230.124.69]:55818: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:49:08 dovecot_login authenticator failed for H=(o0Ik5jJy) [185.169.4.188]:53640: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:49:16 dovecot_login authenticator failed for H=(UvVQE6PkaA) [178.16.54.22]:62003: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.78.236.160
country_id: 1269750
domain: egbwawasan.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59623.egbwawasan.com.my||ServerName:egbwawasan.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c4fbee3a48063394870a1ba39883759d0c213b3||Title:0x2c682b6b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2026-01-31 17:50:38 dovecot_login authenticator failed for H=([152.52.234.222]) [125.22.116.94]:37132: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2026-01-31 17:50:55 dovecot_login authenticator failed for H=([125.18.28.146]) [125.17.185.94]:50021: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:50:03 dovecot_login authenticator failed for H=(Cq0ULqXQfh) [185.169.4.188]:53986: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:50:18 dovecot_login authenticator failed for H=(lqkzyd2HS) [185.230.124.69]:63361: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:51:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.206.86
country_id: 1835841
description:
2026-01-31 17:51:59 dovecot_login authenticator failed for H=([119.202.206.86]) [119.202.206.86]:54010: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:51:15 dovecot_login authenticator failed for H=(AXeQFTb) [185.230.124.69]:61888: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:51:19 dovecot_login authenticator failed for H=(BenEFIGE) [185.169.4.188]:65090: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:52:50 dovecot_login authenticator failed for H=(4IQj7L7h) [185.230.124.69]:57677: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-31 17:52:57 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:54532: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:52:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-31 17:52:50 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:33530: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-01-31 17:52:56 dovecot_login authenticator failed for H=a4.ucndns.in [103.252.168.4]:53952: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:52:12 dovecot_login authenticator failed for H=(oJlfJrJKw) [185.230.124.69]:53458: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-31 17:52:18 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:33866: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:52:09 dovecot_login authenticator failed for H=(8zmIcDY1) [185.169.4.188]:64948: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:53:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.90.10
country_id: 1814991
description:
2026-01-31 17:53:38 dovecot_login authenticator failed for H=([1.26.90.10]) [1.26.90.10]:42418: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:53:03 dovecot_login authenticator failed for H=(OxxTht0N) [185.169.4.188]:49961: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:53:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:53:09 dovecot_login authenticator failed for H=(jArAPOpzAC) [185.230.124.69]:59770: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-31 17:53:27 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:55920: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:54:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:54:20 dovecot_login authenticator failed for H=(yGatkYw) [185.169.4.188]:58819: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-31 17:55:02 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:61607: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:54:40 H=([167.148.167.71]) [167.148.167.71]:54236 F=<Support@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 17:54:44 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:60151: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 17:54:58 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:56102: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:54:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:54:06 dovecot_login authenticator failed for H=(egtVyhan) [185.230.124.69]:51391: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:55:03 dovecot_login authenticator failed for H=(1W86uA) [185.230.124.69]:54487: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:55:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:55:11 dovecot_login authenticator failed for H=(jJ0jZP) [185.169.4.188]:59037: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:55:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:55:28 dovecot_login authenticator failed for H=(zgN7nAZUAp) [2.58.56.77]:53277: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:56:15 dovecot_login authenticator failed for H=(wX9NIHz) [2.58.56.77]:50784: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:56:19 dovecot_login authenticator failed for H=(A4m9MxF) [185.230.124.69]:54530: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-31 17:56:55 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:52299: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 13.75.54.243
country_id: 1819730
domain: zrrtc.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/dpscomsec/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:56:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-31 17:56:34 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:38870: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/dpscomsec/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:56:02 dovecot_login authenticator failed for H=(czNzBmbfZ) [185.169.4.188]:59569: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-31 17:57:32 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:65368: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-01-31 17:57:46 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:33814: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:57:22 dovecot_login authenticator failed for H=(FLEnw0d) [2.58.56.77]:65234: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 17:57:48 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:46278: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:57:19 dovecot_login authenticator failed for H=(H0v1ktU) [185.169.4.188]:51520: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-31 17:57:39 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:39667: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:57:16 dovecot_login authenticator failed for H=(YJlhzG0) [185.230.124.69]:51287: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:57:35 dovecot_login authenticator failed for H=(eO29YLh) [185.230.124.69]:50969: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.15.4
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=107240 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 17:58:48 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:56936: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 17:58:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:58:09 dovecot_login authenticator failed for H=(WcmgLY20) [185.169.4.188]:51638: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.185.110.32
country_id: 2623032
description:
2026-01-31 17:58:26 dovecot_login authenticator failed for H=x5ab96e20.customers.hiper-net.dk [90.185.110.32]:32777: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:58:07 dovecot_login authenticator failed for H=(pYFSG6) [2.58.56.77]:59270: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-31 17:58:18 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:60010: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:58:13 dovecot_login authenticator failed for H=(OfWsCTlCnv) [185.230.124.69]:56310: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:59:02 dovecot_login authenticator failed for H=(Euiuuv) [185.169.4.188]:51976: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.21.209.27
country_id: 1814991
description:
2026-01-31 17:59:05 dovecot_login authenticator failed for H=([60.21.209.27]) [60.21.209.27]:50327: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2026-01-31 17:59:13 dovecot_login authenticator failed for H=(cm-178.232.55.16.get.no) [178.232.55.16]:32896: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:59:10 dovecot_login authenticator failed for H=(XbNLBPR) [185.230.124.69]:52248: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 17:59:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:59:14 dovecot_login authenticator failed for H=(p3VvNavOB) [2.58.56.77]:56291: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:59:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47356.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3324cadccaea6def08b5e009a72246ebee383a97||Title:0xdd18fa75||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:00:06 dovecot_login authenticator failed for H=(Z90SfPoQIA) [185.230.124.69]:57690: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:00:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:00:19 dovecot_login authenticator failed for H=(y7KCkWd) [185.169.4.188]:61228: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 18:00:37 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:36566: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:00:25 dovecot_login authenticator failed for H=(7FqTUi2M) [185.230.124.69]:62094: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:00:03 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:50907: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:00:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.83.174.116
country_id: 1168579
domain: empirelog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37841.empirelog.com.my||ServerName:empirelog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:acdc98eb74f40c9651ce8a63c5a8f8fa73995949||Title:0x2c25e47c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:00:18 dovecot_login authenticator failed for H=(mGDMXRQ5) [2.58.56.77]:65413: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/index.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:01:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-31 18:01:34 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:21280: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:01:02 dovecot_login authenticator failed for H=(39AGJ1pY) [185.230.124.69]:53658: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 18:01:06 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:52941: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:01:12 dovecot_login authenticator failed for H=(QdZEoGYd4z) [185.169.4.188]:62201: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:01:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-01-31 18:01:51 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net [221.120.73.24]:58424: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:01:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:01:03 dovecot_login authenticator failed for H=(Tcf0ethNHH) [2.58.56.77]:52997: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: euratech.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/euratechcom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:02:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:02:37 dovecot_login authenticator failed for H=(nujU835) [185.230.124.69]:50965: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:02:10 dovecot_login authenticator failed for H=(P8GMfYKK) [185.230.124.69]:64484: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:02:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-01-31 18:03:01 dovecot_login authenticator failed for H=([211.63.34.149]) [211.63.34.149]:35122: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:02:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:02:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57220: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:02:03 dovecot_login authenticator failed for H=(7dJBySK3) [185.169.4.188]:63077: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 18:02:04 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:49994: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:02:09 dovecot_login authenticator failed for H=(DKBeTVt2) [2.58.56.77]:64995: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:02:48 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:35417: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-31 18:03:12 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:49734: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:03:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:03:11 dovecot_login authenticator failed for H=(zumjvcV) [2.58.56.77]:62822: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:03:17 dovecot_login authenticator failed for H=(9Kh81Y) [185.169.4.188]:55201: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:03:22 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:40337: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:03:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:03:07 dovecot_login authenticator failed for H=(nEp1Qtqp) [185.230.124.69]:61619: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:03:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:04:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60261: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:04:50 dovecot_login authenticator failed for H=(91Dnh6wgs) [185.230.124.69]:52685: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:04:04 dovecot_login authenticator failed for H=(q3V3g9) [185.230.124.69]:63982: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 18:04:18 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:55544: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-01-31 18:04:29 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:54818: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:04:56 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:48662: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:04:05 dovecot_login authenticator failed for H=(8S2WybE) [185.169.4.188]:55791: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:04:19 dovecot_login authenticator failed for H=(diwafy5jpp) [2.58.56.77]:50946: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 18:04:45 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:45060: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:04:30 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50398: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:04:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 18:05:17 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:43698: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:05:05 dovecot_login authenticator failed for H=(QH4UldJP) [2.58.56.77]:58851: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:05:09 dovecot_login authenticator failed for H=(VhaCmEEeoO) [185.230.124.69]:59659: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:05:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61347: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 18:05:34 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:45814: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:05:19 dovecot_login authenticator failed for H=(3V19TKGr) [185.169.4.188]:64152: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:06:10 dovecot_login authenticator failed for H=(bZUtuhxT) [185.169.4.188]:64603: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:06:12 dovecot_login authenticator failed for H=(sTxcyVEE) [2.58.56.77]:63615: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:06:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62378: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:06:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:06:57 dovecot_login authenticator failed for H=(kVTRqf04) [91.92.240.235]:57138: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:06:06 dovecot_login authenticator failed for H=(Wpk9kU) [185.230.124.69]:59460: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:07:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:07:14 dovecot_login authenticator failed for H=(PYWY05VCcf) [2.58.56.77]:55041: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:07:21 dovecot_login authenticator failed for H=(Abg3N8n) [91.92.240.235]:57739: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.36
country_id: 289688
description:
2026-01-31 18:07:06 dovecot_login authenticator failed for H=(ADMIN) [95.181.234.36]:5073: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:07:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54405: 535 Incorrect authentication data (set_id=test@chs.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:07:03 dovecot_login authenticator failed for H=(8hvXlA) [185.230.124.69]:59593: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:07:14 dovecot_login authenticator failed for H=(uxMLmk) [185.230.124.69]:50795: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:07:24 dovecot_login authenticator failed for H=(uDapDC3JXM) [185.169.4.188]:57749: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-31 18:08:05 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:56113: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.92.129.37
country_id: 6252001
description:
[2026-01-31 18:08:22 +0800] info [cpaneld] 99.92.129.37 - tsch "GET /login/?login_only=1&user=tsch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tsch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.182.245.30
country_id: 6252001
description:
[2026-01-31 18:08:11 +0800] info [cpaneld] 97.182.245.30 - tschuancom "GET /login/?login_only=1&user=tschuancom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschuancom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:08:16 dovecot_login authenticator failed for H=(v4ak208RH) [185.169.4.188]:58015: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.71.196.104
country_id: 6252001
description:
[2026-01-31 18:08:25 +0800] info [cpaneld] 173.71.196.104 - tsc "GET /login/?login_only=1&user=tsc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tsc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 18:08:33 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:47940: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:08:11 dovecot_login authenticator failed for H=(zbueJfi) [185.230.124.69]:64470: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.19.11
country_id: 6252001
description:
[2026-01-31 18:08:14 +0800] info [cpaneld] 152.86.19.11 - tschua "GET /login/?login_only=1&user=tschua&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschua (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.19.87
country_id: 2017370
description:
2026-01-31 18:08:28 dovecot_login authenticator failed for H=([195.239.19.87]) [195.239.19.87]:55386: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.132.135.140
country_id: 6252001
description:
[2026-01-31 18:08:04 +0800] info [cpaneld] 47.132.135.140 - tschuan "GET /login/?login_only=1&user=tschuan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.184.231.176
country_id: 6252001
description:
[2026-01-31 18:08:28 +0800] info [cpaneld] 76.184.231.176 - ts "GET /login/?login_only=1&user=ts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ts (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:08:10 dovecot_login authenticator failed for H=(99PNHZxomp) [91.92.240.235]:60882: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2026-01-31 18:08:48 dovecot_login authenticator failed for H=([111.93.177.228]) [111.93.177.228]:57294: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:08:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:08:21 dovecot_login authenticator failed for H=(Vz2GkUZd1) [2.58.56.77]:64320: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-31 18:08:50 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:57638: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.92.232.8
country_id: 6252001
description:
[2026-01-31 18:08:16 +0800] info [cpaneld] 69.92.232.8 - tschu "GET /login/?login_only=1&user=tschu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.27.231.134
country_id: 6252001
description:
[2026-01-31 18:08:06 +0800] info [cpaneld] 45.27.231.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:09:16 dovecot_login authenticator failed for H=(d2mHb9nFq) [185.230.124.69]:53423: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 18:09:49 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:42701: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:09:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62775: 535 Incorrect authentication data (set_id=test@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:09:04 dovecot_login authenticator failed for H=(RpXhgbba) [2.58.56.77]:50447: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:09:10 dovecot_login authenticator failed for H=(vdwBdn0) [185.169.4.188]:58823: 535 Incorrect authentication data (set_id=vincent)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home2/cabecom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:09:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:09:23 dovecot_login authenticator failed for H=(IgpNlK) [91.92.240.235]:63773: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:09:29 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58575: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2026-01-31 18:09:23 dovecot_login authenticator failed for H=([60.216.89.122]) [60.216.89.122]:46864: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2026-01-31 18:09:07 dovecot_login authenticator failed for H=([220.178.246.43]) [220.178.246.43]:48917: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: tptec.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/tptecadmin/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:09:08 dovecot_login authenticator failed for H=(xf0a8aJh) [185.230.124.69]:54013: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2026-01-31 18:11:01 dovecot_login authenticator failed for H=([27.123.119.146]) [122.187.172.98]:38794: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
country_id: 1814991
description:
2026-01-31 18:10:05 dovecot_login authenticator failed for H=([61.185.30.170]) [61.185.30.170]:47400: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:10:13 dovecot_login authenticator failed for H=(2Gu198) [2.58.56.77]:60137: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.187.231.185
country_id: 953987
description:
2026-01-31 18:10:15 dovecot_login authenticator failed for H=([41.149.42.161]) [105.187.231.185]:57875: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:10:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:10:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:10:12 dovecot_login authenticator failed for H=(UTUYYFhZx) [91.92.240.235]:57010: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 18:10:53 H=([45.144.212.50]) [45.144.212.50]:62757 F=<ccmsservice@bangkokbank.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:10:05 dovecot_login authenticator failed for H=(YT5Kaz) [185.230.124.69]:59164: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:10:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64587: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:10:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:10:28 dovecot_login authenticator failed for H=(ovTzLSurQ) [185.169.4.188]:52770: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.216
country_id: 1668284
description:
2026-01-31 18:10:57 dovecot_login authenticator failed for H=111-70-39-216.emome-ip.hinet.net [111.70.39.216]:41247: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:11:21 dovecot_login authenticator failed for H=(VifL4Qlu) [185.169.4.188]:51728: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 18:11:57 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:51055: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:11:06 dovecot_login authenticator failed for H=(Ent0sna) [91.92.240.235]:50111: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:11:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:11:20 dovecot_login authenticator failed for H=(m4xaQs) [2.58.56.77]:53064: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2026-01-31 18:11:20 dovecot_login authenticator failed for H=([149.54.62.2]) [149.54.62.2]:48803: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:11:02 dovecot_login authenticator failed for H=(NafGPn4) [185.230.124.69]:63806: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:11:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63018: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:11:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:11:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:11:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53156: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:11:15 H=([167.148.167.71]) [167.148.167.71]:63258 F=<Support@hmz.com.my> rejected RCPT <hr@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2026-01-31 18:11:58 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:56222: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:11:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-01-31 18:11:50 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:55258: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 18:12:15 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:59652: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:12:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:12:13 dovecot_login authenticator failed for H=(AfgV6q7hP) [185.169.4.188]:51121: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:12:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51401: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/egbwawasancom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:12:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:12:21 dovecot_login authenticator failed for H=(HLmJMQA) [2.58.56.77]:56166: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 18:12:23 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:45502: 535 Incorrect authentication data (set_id=jaya@ds-staffing.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:12:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:12:07 dovecot_login authenticator failed for H=(sXjR4FoY6) [185.230.124.69]:54776: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:12:21 dovecot_login authenticator failed for H=(pkKW6h1zF) [91.92.240.235]:58043: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:13:04 dovecot_login authenticator failed for H=(QxivDm) [185.230.124.69]:57159: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 18:13:22 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:39562: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:13:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:13:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:13:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:13:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61714: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 18:13:28 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:48678: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-01-31 18:13:07 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (tuorate) [24.61.199.212]:58074: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:13:24 dovecot_login authenticator failed for H=(0OTZujv) [2.58.56.77]:64015: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:13:05 dovecot_login authenticator failed for H=(cK0D9naj) [185.169.4.188]:55275: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:13:11 dovecot_login authenticator failed for H=(enkTjrgHo) [91.92.240.235]:63077: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:13:34 dovecot_login authenticator failed for H=(zhIVnMo) [185.230.124.69]:63264: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 18:13:44 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:44679: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:14:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.231.173
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27331514528878 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:14:53 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:53191: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:14:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.153.106
country_id: 1562822
description:
2026-01-31 18:14:04 dovecot_plain authenticator failed for H=(6MB1PQ8V7O8RZW8) [117.5.153.106]:34443: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:14:03 dovecot_login authenticator failed for H=(zZQLYZu) [91.92.240.235]:52766: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:14:08 dovecot_login authenticator failed for H=(B9RqKb) [2.58.56.77]:55912: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:14:12 dovecot_login authenticator failed for H=(5WuUaU4) [185.230.124.69]:62321: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:14:17 dovecot_login authenticator failed for H=(xHCTX4bU) [185.169.4.188]:59298: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:15:47 dovecot_login authenticator failed for H=(7lenKebAZ6) [185.230.124.69]:49591: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:15:15 dovecot_login authenticator failed for H=(iD55bV) [2.58.56.77]:50356: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31 18:15:26 47144 [Warning] Aborted connection 47144 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:15:07 dovecot_login authenticator failed for H=(YbAZX5Zg) [185.169.4.188]:60236: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:15:17 dovecot_login authenticator failed for H=(v1RxGKRK3) [91.92.240.235]:61306: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:15:19 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:36294: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:15:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 18:16:01 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:46560: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 18:15:03 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:54732: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:15:09 dovecot_login authenticator failed for H=(EJ2cUxqanz) [185.230.124.69]:52024: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:15:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:15:16 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:59179: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-31 18:15:47 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:34622: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-31 18:15:58 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:38828: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 18:16:52 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:46024: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:16:06 dovecot_login authenticator failed for H=(94b4EIsC) [185.230.124.69]:57477: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-31 18:16:07 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:10970: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.174.104.74
country_id: 2017370
description:
2026-01-31 18:16:15 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [109.174.104.74]:55916: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:16:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 18:16:54 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:34550: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:16:07 dovecot_login authenticator failed for H=(pwsVJcNQbC) [91.92.240.235]:55303: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:16:21 dovecot_login authenticator failed for H=(gPhI1E6) [185.169.4.188]:57339: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:16:22 dovecot_login authenticator failed for H=(jDeGBwzVkX) [2.58.56.77]:51963: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:16:55 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:53663: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:17:20 dovecot_login authenticator failed for H=(9c72VG3bWF) [91.92.240.235]:53448: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:17:59 dovecot_login authenticator failed for H=(0k1a6ws) [185.230.124.69]:61649: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 18:17:03 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:33252: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:17:10 dovecot_login authenticator failed for H=(qptUFd0a) [2.58.56.77]:50209: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 18:17:32 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:58014: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:17:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:17:09 dovecot_login authenticator failed for H=(raBPVZ) [185.169.4.188]:56611: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:17:12 dovecot_login authenticator failed for H=(baeBJoa) [185.230.124.69]:58265: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:17:15 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:35321: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 18:17:34 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:20400: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 18:17:42 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:50903: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:18:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59347: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:18:15 dovecot_login authenticator failed for H=(dfEopvIF) [2.58.56.77]:65473: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:18:22 dovecot_login authenticator failed for H=(omDpAOoG) [185.169.4.188]:57136: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-31 18:18:06 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:51745: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-31 18:18:09 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:13360: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-31 18:18:44 dovecot_login authenticator failed for H=([125.17.10.161]) [182.95.58.18]:44234: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:18:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:18:11 dovecot_login authenticator failed for H=(ns6mIS) [91.92.240.235]:50754: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:18:09 dovecot_login authenticator failed for H=(NBV8CPejAH) [185.230.124.69]:62038: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-31 18:18:47 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:56835: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:18:28 H=([167.148.167.71]) [167.148.167.71]:60077 F=<Support@indfinitydesign.com> rejected RCPT <ind@indfinitydesign.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 18:18:15 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:35501: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2026-01-31 18:18:54 dovecot_login authenticator failed for H=201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:43570: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-31 18:19:14 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:54050: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 18:19:22 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:58503: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:19:23 dovecot_login authenticator failed for H=(TvQF1wXet) [91.92.240.235]:54198: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:19:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
country_id: 1814991
description:
2026-01-31 18:19:03 dovecot_login authenticator failed for H=mail.toptronicsinc.com [218.4.156.254]:38112: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:19:08 dovecot_login authenticator failed for H=(cxLnuB) [185.169.4.188]:55204: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-01-31 18:19:11 dovecot_login authenticator failed for H=([121.142.146.165]) [121.142.146.165]:32870: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-31 18:19:57 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:48224: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:19:04 dovecot_login authenticator failed for H=(cvtQ6LRdF) [2.58.56.77]:65020: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:19:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:19:06 dovecot_login authenticator failed for H=(rTOBlM) [185.230.124.69]:59084: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:19:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:20:03 dovecot_login authenticator failed for H=(ceAwe8) [185.230.124.69]:57216: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:20:14 dovecot_login authenticator failed for H=(VqXNEm16) [91.92.240.235]:64355: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:20:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:20:21 dovecot_login authenticator failed for H=(9JZzPo) [185.169.4.188]:58451: 535 Incorrect authentication data (set_id=vincent)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.126.36.5
country_id: 1210997
domain: euratech.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11506.euratech.com.my||ServerName:euratech.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b32ac2d25618bdd9a54abd65d1d40ca4a04e8dc||Title:0xe61bf3e1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:20:11 dovecot_login authenticator failed for H=(uAELglwY4W) [2.58.56.77]:52963: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:20:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:20:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.253.100.67
country_id: 1269750
domain: euratech.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60019.euratech.com.my||ServerName:euratech.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e4ddbd078d662b415e140778a87daaa7eff0e8c||Title:0xdcd68d74||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:20:25 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52220: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-31 18:20:06 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:44098: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:20:12 dovecot_login authenticator failed for H=(mXRPaGk) [185.230.124.69]:51087: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:20:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:21:09 dovecot_login authenticator failed for H=(dSQcKyESu) [185.230.124.69]:59089: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-31 18:21:40 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:57514: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:21:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:21:26 dovecot_login authenticator failed for H=(dqAKVXZmi) [91.92.240.235]:57605: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.215.41.63
country_id: 357994
description:
2026-01-31 18:21:03 dovecot_plain authenticator failed for H=(6MB1PQ8V7O8RZW8) [156.215.41.63]:64627: 535 Incorrect authentication data (set_id=norhayati.ab-samad@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:21:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:21:53 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53916: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:21:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:21:07 dovecot_login authenticator failed for H=(3vIDIRrPV) [185.169.4.188]:64316: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:21:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:21:21 dovecot_login authenticator failed for H=(NM2phFi) [2.58.56.77]:55849: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.228.75
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:22:10 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60734: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:22:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:22:06 dovecot_login authenticator failed for H=(iFh7ti) [185.230.124.69]:50843: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:22:20 dovecot_login authenticator failed for H=(bLYofUEL2) [185.169.4.188]:56488: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:22:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:22:25 dovecot_login authenticator failed for H=(2dfbbT4e) [185.230.124.69]:55584: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 18:23:00 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:51385: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:22:04 dovecot_login authenticator failed for H=(WGtUr5KSr) [2.58.56.77]:49442: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:22:15 dovecot_login authenticator failed for H=(Ik8uJFTd) [91.92.240.235]:64409: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:22:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:23:45 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62313: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-01-31 18:23:12 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net [111.70.49.182]:37846: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:23:09 dovecot_login authenticator failed for H=(ooJLgZyl) [185.169.4.188]:56031: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:23:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:23:12 dovecot_login authenticator failed for H=(6UjJV7tt) [2.58.56.77]:62885: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 18:23:53 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:38940: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:23:03 dovecot_login authenticator failed for H=(MyASIg0) [185.230.124.69]:50042: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:23:05 dovecot_login authenticator failed for H=(OMcxz2) [91.92.240.235]:58331: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.107.242.43
country_id: 248816
description:
2026-01-31 18:23:24 dovecot_plain authenticator failed for H=(E7G74M1Q) [109.107.242.43]:55663: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:23:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:24:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:24:19 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55523: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:24:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:24:23 dovecot_login authenticator failed for H=(WlZ4ufHfvK) [185.169.4.188]:63534: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-31 18:24:09 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:38572: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:24:10 dovecot_login authenticator failed for H=(tCZ4jbRI4) [185.230.124.69]:58087: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:24:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:24:18 dovecot_login authenticator failed for H=(RgP9HhM4) [91.92.240.235]:63518: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:24:24 dovecot_login authenticator failed for H=(QUBVDzOPdZ) [2.58.56.77]:60151: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2026-01-31 18:24:26 dovecot_login authenticator failed for H=([111.26.79.112]) [111.26.79.112]:57896: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:24:38 dovecot_login authenticator failed for H=(Psn5CEQyf) [185.230.124.69]:63421: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:25:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:25:08 dovecot_login authenticator failed for H=(JM87Mc) [91.92.240.235]:62193: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:25:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:25:06 dovecot_login authenticator failed for H=(Ndyvo7) [2.58.56.77]:62899: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:25:07 dovecot_login authenticator failed for H=(2GdfBrhIk) [185.230.124.69]:57241: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:25:10 dovecot_login authenticator failed for H=(mjCext) [185.169.4.188]:63392: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.105.11
country_id: 3469034
description:
2026-01-31 18:26:20 dovecot_login authenticator failed for H=(faculdadeunica.static.gvt.net.br) [177.43.105.11]:47768: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:26:21 dovecot_login authenticator failed for H=(z4R7JaH) [185.169.4.188]:53248: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:26:24 dovecot_login authenticator failed for H=(uUoxCI7bBr) [91.92.240.235]:52402: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-31 18:26:39 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:46109: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:26:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.21.209.27
country_id: 1814991
description:
2026-01-31 18:26:59 dovecot_login authenticator failed for H=([60.21.209.27]) [60.21.209.27]:65149: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:26:04 dovecot_login authenticator failed for H=(rDtgWGJ26) [185.230.124.69]:63025: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:26:17 dovecot_login authenticator failed for H=(Kgm9MBOh) [2.58.56.77]:61536: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 18:27:13 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:60562: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:27:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:27:30 dovecot_login authenticator failed for H=(b0FiQz) [185.230.124.69]:50310: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:27:06 dovecot_login authenticator failed for H=(R5ZQyD) [2.58.56.77]:51306: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:27:11 dovecot_login authenticator failed for H=(VvrP91q) [185.169.4.188]:51285: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:27:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56493: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:27:10 dovecot_login authenticator failed for H=(zHnizZI5) [185.230.124.69]:56778: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:27:14 dovecot_login authenticator failed for H=(WqzWM0VP) [91.92.240.235]:59407: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:28:05 dovecot_login authenticator failed for H=(N3zNCHB) [91.92.240.235]:60852: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:28:09 dovecot_login authenticator failed for H=(6OKSx7th) [185.230.124.69]:49572: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:28:10 dovecot_login authenticator failed for H=(2dkYeEiOL) [69.5.189.21]:59414: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:28:10 dovecot_login authenticator failed for H=(r2mK4aJpkX) [2.58.56.77]:64030: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:28:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:28:21 dovecot_login authenticator failed for H=(pArgBvIYw) [185.169.4.188]:60884: 535 Incorrect authentication data (set_id=vincent)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.77.66
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/smart.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:29:22 dovecot_login authenticator failed for H=(2uLFFH) [2.58.56.77]:51381: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:29:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:29:38 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53242: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:29:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-01-31 18:29:55 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:31370: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:29:11 dovecot_login authenticator failed for H=(qxMYLYi) [185.169.4.188]:61383: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:29:21 dovecot_login authenticator failed for H=(BejHdRa8e) [69.5.189.21]:54746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:29:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:29:36 dovecot_login authenticator failed for H=(RhrFzGT2) [91.92.240.235]:62686: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:29:06 dovecot_login authenticator failed for H=(LBCRVC) [185.230.124.69]:55746: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:30:24 dovecot_login authenticator failed for H=(5BQieqW) [91.92.240.235]:56852: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-01-31 18:30:38 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:41220: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-31 18:30:42 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:52076: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:30:03 dovecot_login authenticator failed for H=(Xn6ALW) [185.230.124.69]:54939: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:30:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:30:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:30:07 dovecot_login authenticator failed for H=(iUhVwKZC) [69.5.189.21]:62333: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:30:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:30:06 dovecot_login authenticator failed for H=(kPbwYC) [2.58.56.77]:56778: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 18:30:19 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:48713: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-31 18:30:41 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:33691: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 18:30:47 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:39718: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:30:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51688: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.69.202.32
country_id: 357994
description:
2026-01-31 18:31:38 dovecot_plain authenticator failed for H=(E43HFC1) [41.69.202.32]:12082: 535 Incorrect authentication data (set_id=teng.info@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-31 18:31:52 dovecot_login authenticator failed for H=([36.135.62.102]) [36.135.62.103]:47288: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:31:12 dovecot_login authenticator failed for H=(fU4Ewi3) [91.92.240.235]:63720: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:31:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:31:19 dovecot_login authenticator failed for H=(M8MYlel) [185.230.124.69]:60025: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:31:32 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50065: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 18:31:13 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:38564: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:31:17 dovecot_login authenticator failed for H=(OcXlNLX) [2.58.56.77]:53054: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:31:19 dovecot_login authenticator failed for H=(ScemxTS2A) [69.5.189.21]:56415: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:31:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:31:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:31:38 dovecot_login authenticator failed for H=(4pOiILVeo) [185.230.124.69]:64119: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:32:02 dovecot_login authenticator failed for H=(XARtaXL) [91.92.240.235]:61979: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:32:09 dovecot_login authenticator failed for H=(i9RVoirMB) [2.58.56.77]:59290: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:32:16 dovecot_login authenticator failed for H=(yGknaTLoCL) [185.230.124.69]:63406: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-31 18:32:41 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:57204: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:32:05 dovecot_login authenticator failed for H=(5XJeKg9fD) [69.5.189.21]:64008: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:32:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:32:30 dovecot_login authenticator failed for H=(eaNK4thLd) [158.94.208.175]:62592: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:33:01 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:53516: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:32:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 18:32:49 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:57290: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:33:03 dovecot_login authenticator failed for H=(gdzsHWYLA) [158.94.208.175]:51397: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:33:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:33:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:33:16 dovecot_login authenticator failed for H=(Hyv1ZEyDu) [69.5.189.21]:59227: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-01-31 18:33:03 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [177.174.0.3]:60141: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:33:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:33:13 dovecot_login authenticator failed for H=(vQnUtlI) [185.230.124.69]:61325: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31 18:33:16 47856 [Warning] Aborted connection 47856 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:33:17 dovecot_login authenticator failed for H=(MjYCsm) [91.92.240.235]:63236: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:33:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51825: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:33:12 dovecot_login authenticator failed for H=(RcReRY7XwF) [2.58.56.77]:62747: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 18:33:18 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:36342: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 18:33:31 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:40298: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: hmz.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/hmzcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:34:06 dovecot_login authenticator failed for H=(O1nfJfLNb) [91.92.240.235]:60322: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:34:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:34:19 dovecot_login authenticator failed for H=(Y1gpLT7I80) [2.58.56.77]:50401: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:34:02 dovecot_login authenticator failed for H=(AVFGw2) [69.5.189.21]:50254: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:34:10 dovecot_login authenticator failed for H=(zBi6ul) [185.230.124.69]:52387: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:34:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52864: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.253.134
country_id: 1210997
description:
2026-01-31 18:34:42 dovecot_plain authenticator failed for H=(0SD7X7I) [223.25.253.134]:4390: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:34:06 dovecot_login authenticator failed for H=(loXGpJPoeI) [158.94.208.175]:52357: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:35:13 dovecot_login authenticator failed for H=(Kn3c0r) [69.5.189.21]:61760: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.30.85
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=13 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:35:05 dovecot_login authenticator failed for H=(ZB0f953Rlb) [2.58.56.77]:58847: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:35:07 dovecot_login authenticator failed for H=(Dyqt7f0) [185.230.124.69]:52288: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:35:39 dovecot_login authenticator failed for H=(4zAwou5H) [91.92.240.235]:55136: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:35:05 dovecot_login authenticator failed for H=(eejOFCeAbT) [158.94.208.175]:61152: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:36:05 dovecot_login authenticator failed for H=(N0oZ4V8Zrh) [185.230.124.69]:54810: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:36:05 dovecot_login authenticator failed for H=(QpBjzw) [158.94.208.175]:53092: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:36:12 dovecot_login authenticator failed for H=(C5wX0Ssyj8) [2.58.56.77]:51682: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.154
country_id: 2960313
description:
2026-01-31 18:36:48 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.154]:47959: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 18:36:42 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:37939: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:36:24 dovecot_login authenticator failed for H=(RL8boKK6y) [185.230.124.69]:51335: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:36:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:36:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52704: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-01-31 18:36:19 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:64255: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-31 18:36:36 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:40262: 535 Incorrect authentication data (set_id=infos@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:36:03 dovecot_login authenticator failed for H=(0HyZiaK3) [91.92.240.235]:64200: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:36:18 H=([167.148.167.71]) [167.148.167.71]:62645 F=<Support@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2026-01-31 18:36:53 dovecot_login authenticator failed for H=([220.161.52.149]) [220.161.52.149]:34378: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:37:17 dovecot_login authenticator failed for H=(g3jWDq5) [91.92.240.235]:57227: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:37:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.255.253
country_id: 1562822
description:
2026-01-31 18:37:26 dovecot_plain authenticator failed for H=(cclyv5vl8mqvnw5s) [103.245.255.253]:33777: 535 Incorrect authentication data (set_id=nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:37:27 dovecot_login authenticator failed for H=(SkG0zSpX) [158.94.208.175]:54167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2026-01-31 18:37:59 dovecot_login authenticator failed for H=([1.30.20.238]) [1.30.20.238]:51908: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:37:15 dovecot_login authenticator failed for H=(MFybGmzD) [2.58.56.77]:55389: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-31 18:37:43 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:43922: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:37:04 dovecot_login authenticator failed for H=(9OYQsvd) [185.230.124.69]:61000: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.231.153
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=670775 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:38:22 dovecot_login authenticator failed for H=(wN0Ug0H0AF) [2.58.56.77]:53502: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:38:23 H=([167.148.167.71]) [167.148.167.71]:49482 F=<Support@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:38:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:38:05 dovecot_login authenticator failed for H=(ISDKJ0) [91.92.240.235]:61578: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:38:30 dovecot_login authenticator failed for H=(3N2x2en) [158.94.208.175]:52286: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:38:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:38:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:38:58 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49692: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:39:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:39:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:39:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61765: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:39:21 dovecot_login authenticator failed for H=(IEjo530J) [91.92.240.235]:54503: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:39:05 dovecot_login authenticator failed for H=(p131jq9lvX) [2.58.56.77]:56888: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:39:14 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:39186: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 18:40:52 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:52864: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 18:40:39 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:65371: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 18:40:50 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:52688: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:40:19 dovecot_login authenticator failed for H=(4yDwkB) [2.58.56.77]:52643: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:40:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:40:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:40:08 dovecot_login authenticator failed for H=(b4wmKxjH0) [158.94.208.175]:57805: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 18:40:23 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:50988: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:40:09 dovecot_login authenticator failed for H=(M1SZ9Pa) [91.92.240.235]:52980: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-01-31 18:40:20 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:24332: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:41:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:41:05 dovecot_login authenticator failed for H=(xunSVI) [2.58.56.77]:60013: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 18:41:14 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:58064: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:41:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:41:26 dovecot_login authenticator failed for H=(XSNbBW) [2.58.56.77]:50212: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2026-01-31 18:41:56 dovecot_login authenticator failed for H=([87.229.254.207]) [87.229.254.207]:59414: 535 Incorrect authentication data (set_id=infos@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:41:04 dovecot_login authenticator failed for H=(pBu6lk3) [158.94.208.175]:49264: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:41:23 dovecot_login authenticator failed for H=(Fhdidm) [91.92.240.235]:54962: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 18:41:31 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:56483: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.42.197.140
country_id: 1269750
description:
2026-01-31 18:41:46 dovecot_plain authenticator failed for H=(1VT5KO7) [103.42.197.140]:13217: 535 Incorrect authentication data (set_id=teng.info@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:42:11 dovecot_login authenticator failed for H=(gPKkOgF) [2.58.56.77]:53516: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2026-01-31 18:42:24 dovecot_login authenticator failed for H=([223.210.27.53]) [223.210.27.53]:6710: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:42:27 dovecot_login authenticator failed for H=(idGuLX) [158.94.208.175]:58967: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.99.130.2
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87911523583434 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:42:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:42:11 dovecot_login authenticator failed for H=(z5ts5Cf) [91.92.240.235]:58672: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-01-31 18:42:37 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:55127: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.86.148.242
country_id: 1814991
description:
2026-01-31 18:42:45 dovecot_login authenticator failed for H=([223.86.148.242]) [223.86.148.242]:27491: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 18:42:46 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:44317: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 18:43:49 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:42056: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:43:17 dovecot_login authenticator failed for H=(jWD8QchNFa) [2.58.56.77]:62044: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:43:25 dovecot_login authenticator failed for H=(DHCIcpQwuO) [158.94.208.175]:53740: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:43:26 dovecot_login authenticator failed for H=(NF7JbGw) [91.92.240.235]:50680: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:43:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:44:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:44:04 dovecot_login authenticator failed for H=(z9bifq3L6Z) [2.58.56.77]:57341: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:44:57 dovecot_login authenticator failed for H=(PSjKFO) [185.91.69.136]:52858: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:44:14 dovecot_login authenticator failed for H=(sA1Yxudg2) [91.92.240.235]:62059: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:44:23 dovecot_login authenticator failed for H=(Munu2GZH) [158.94.208.175]:50541: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 157.230.46.223
country_id: 1880251
domain: geminiflourmill.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:44:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57646: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.102.233
country_id: 1814991
description:
2026-01-31 18:45:17 dovecot_login authenticator failed for H=([183.236.102.233]) [183.236.102.233]:42186: 535 Incorrect authentication data (set_id=infos@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:45:08 dovecot_login authenticator failed for H=(BXfID3Eipj) [2.58.56.77]:50735: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:45:27 dovecot_login authenticator failed for H=(Zz8E8S) [91.92.240.235]:65008: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.68.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=37401514884338 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:45:30 dovecot_login authenticator failed for H=(2jomuDE6) [158.94.208.175]:61261: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-31 18:45:33 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:52514: 535 Incorrect authentication data (set_id=infos)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:45:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.72.22
country_id: 3017382
description:
2026-01-31 18:45:08 dovecot_plain authenticator failed for H=22.ip-79-137-72.eu (69ssn7nivtorl359btmo92z3ht9dg) [79.137.72.22]:62929: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:45:46 dovecot_login authenticator failed for H=(ZCkEgWDTl) [185.91.69.136]:58299: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:46:03 dovecot_login authenticator failed for H=(E3gSbO) [158.94.208.175]:63463: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:46:12 dovecot_login authenticator failed for H=(nqjDzpQZu) [185.91.69.136]:61352: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:46:17 dovecot_login authenticator failed for H=(76ySh8WN) [91.92.240.235]:63543: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:46:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:46:31 dovecot_login authenticator failed for H=(2F1xg61WBH) [2.58.56.77]:61748: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:46:09 dovecot_login authenticator failed for H=(UyaAamoeH7) [2.58.56.77]:59068: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:47:18 dovecot_login authenticator failed for H=(FnZm06Kx3P) [2.58.56.77]:54858: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:47:26 dovecot_login authenticator failed for H=(QnscDwD) [91.92.240.235]:51045: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:47:03 dovecot_login authenticator failed for H=(90iIQeyL3) [185.91.69.136]:51722: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:47:09 dovecot_login authenticator failed for H=(KHXLlOxZUL) [158.94.208.175]:57858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:47:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:48:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 18:48:04 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:47405: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2026-01-31 18:48:17 dovecot_login authenticator failed for H=([121.189.226.81]) [121.189.226.81]:45778: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-31 18:48:39 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:55852: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-31 18:48:04 dovecot_login authenticator failed for H=(aes-static-057.154.22.125.airtel.in) [182.95.119.30]:60888: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:48:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:48:16 dovecot_login authenticator failed for H=(SHt8wn) [91.92.240.235]:63082: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-01-31 18:48:03 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:41842: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 18:48:59 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:51774: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:48:06 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:46104: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:48:05 dovecot_login authenticator failed for H=(a1QBFLeHu) [2.58.56.77]:50576: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:48:13 dovecot_login authenticator failed for H=(bo84kUW) [158.94.208.175]:57457: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2026-01-31 18:48:24 dovecot_login authenticator failed for H=([112.168.71.109]) [112.168.71.109]:56710: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.113
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46061514946811 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:49:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-31 18:49:48 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:35866: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-31 18:49:53 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:43796: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.248.146
country_id: 1269750
description:
2026-01-31 18:49:59 dovecot_login authenticator failed for H=([122.184.117.237]) [128.185.248.146]:43526: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:49:04 dovecot_login authenticator failed for H=(V3qL4x) [91.92.240.235]:63393: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:49:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:49:35 dovecot_login authenticator failed for H=(S2JuFLQgCU) [185.91.69.136]:53558: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 18:49:38 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:42857: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:49:07 H=([167.148.167.71]) [167.148.167.71]:55782 F=<Support@ktlog.com.my> rejected RCPT <inquiries@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:49:08 dovecot_login authenticator failed for H=(RKxzNo) [158.94.208.175]:62953: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 18:49:18 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:55521: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.93.89.64
country_id: 130758
description:
Jan 31 18:49:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(185.93.89.64)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 18:49:48 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:54256: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:49:06 dovecot_login authenticator failed for H=(I6x7oJ9yK) [2.58.56.77]:57043: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:50:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:50:11 dovecot_login authenticator failed for H=(geRJj4) [2.58.56.77]:49431: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-31 18:50:13 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:53896: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2026-01-31 18:50:10 dovecot_login authenticator failed for H=(p187-43.samaralan.ru) [85.236.187.43]:48170: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-01-31 18:50:13 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:52492: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-01-31 18:50:27 dovecot_login authenticator failed for H=([1.247.245.61]) [1.247.245.61]:45387: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.70
country_id: 1835841
description:
2026-01-31 18:50:10 dovecot_login authenticator failed for H=([106.246.89.70]) [106.246.89.70]:43237: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.112.194.160
country_id: 1814991
description:
2026-01-31 18:50:14 dovecot_login authenticator failed for H=([106.112.194.160]) [106.112.194.160]:38474: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-31 18:50:01 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:50068: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:50:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:50:17 dovecot_login authenticator failed for H=(A8tgEPQ) [91.92.240.235]:56499: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:50:10 dovecot_login authenticator failed for H=(WXWjyb) [158.94.208.175]:56243: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:51:34 dovecot_login authenticator failed for H=(njQgpD0) [2.58.56.77]:62680: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:51:15 dovecot_login authenticator failed for H=(iyuYBwv) [158.94.208.175]:52380: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.163.21
country_id: 1269750
domain: evergrown.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68104.evergrown.com.my||ServerName:evergrown.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b79048020d1d9bf5927f436c35355c155b5554a1||Title:0xae2b1524||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:51:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2026-01-31 18:51:32 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:40362: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2026-01-31 18:51:42 dovecot_login authenticator failed for H=([121.134.31.193]) [121.134.31.193]:50825: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:51:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:51:06 dovecot_login authenticator failed for H=(u4fJgY) [91.92.240.235]:53533: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2026-01-31 18:51:44 dovecot_login authenticator failed for H=([111.26.67.35]) [111.26.67.36]:45012: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-01-31 18:51:51 dovecot_login authenticator failed for H=(nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:51297: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:51:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:51:15 dovecot_login authenticator failed for H=(wV0RFOYtI) [2.58.56.77]:59401: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:52:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:52:18 dovecot_login authenticator failed for H=(lQoZbA) [91.92.240.235]:56457: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.60.154.106
country_id: 1168579
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:33395.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:448416aaa064125082fd82bb8ac79428eca258d6||Title:0xc18ec0ec||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:52:15 dovecot_login authenticator failed for H=(juHyfvCApm) [2.58.56.77]:51332: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:52:16 dovecot_login authenticator failed for H=(rkvftZU2J) [158.94.208.175]:58349: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 18:52:17 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:54341: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:52:37 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:65035: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-31 18:52:09 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:43008: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:52:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:52:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 18:52:53 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:57500: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:53:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:53:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.10.217.223
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Builder/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:53:17 dovecot_login authenticator failed for H=(LLm7Hn70YE) [2.58.56.77]:54554: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.236.119.62
country_id: 1880251
description:
Jan 31 18:53:24 sv3 pure-ftpd[177318]: (?@47.236.119.62) [WARNING] Authentication failed for user [woodlinetrd@gmail.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:53:11 dovecot_login authenticator failed for H=(b1OhXxa) [158.94.208.175]:49296: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:53:08 dovecot_login authenticator failed for H=(CLWgyHRew) [91.92.240.235]:49827: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:53:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60364: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.202.218
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Builder HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/advi3535/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:54:24 dovecot_login authenticator failed for H=(2YEzup) [158.94.208.175]:65082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:54:18 dovecot_login authenticator failed for H=(0uICWAMWNz) [91.92.240.235]:58043: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.211.164.12
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/advi3535/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:54:04 dovecot_login authenticator failed for H=(0o2O7GSVC) [2.58.56.77]:64513: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.105.111.144
country_id: 2017370
description:
2026-01-31 18:54:07 dovecot_plain authenticator failed for H=(pji2cldwa9b7cqnrr1i) [185.105.111.144]:42580: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.2.109.8
country_id: 1694008
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77196.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eff7c20379d8d671e5d1debea3fc71e79513a225||Title:0x21339710||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:54:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:55:07 dovecot_login authenticator failed for H=(H8vrU5d) [91.92.240.235]:52689: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-01-31 18:55:44 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:34734: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 18:55:02 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:59768: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.118.42
country_id: 2921044
description:
2026-01-31 18:55:18 dovecot_plain authenticator failed for H=vps-249871a3.vps.ovh.net (WIN-A2HH3EVVM7G.openstacklocal) [57.129.118.42]:49615: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:55:02 dovecot_login authenticator failed for H=(0YeHliVMX) [158.94.208.175]:53116: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 18:55:14 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:56128: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.200.240.65
country_id: 2017370
description:
2026-01-31 18:55:28 dovecot_plain authenticator failed for H=ismtj.co (ihvunh8iv3zyao44ljdang1) [185.200.240.65]:45342: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:55:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:55:10 dovecot_login authenticator failed for H=(iHG5fl) [2.58.56.77]:62244: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:56:21 dovecot_login authenticator failed for H=(cV7t95n) [91.92.240.235]:58886: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:56:21 dovecot_login authenticator failed for H=(dwLIusm) [158.94.208.175]:65184: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.61.81
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88061522226299 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:56:41 dovecot_login authenticator failed for H=(YhsWOvoNax) [2.58.56.77]:50596: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 18:56:02 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:34508: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:56:19 dovecot_login authenticator failed for H=(atvAcOwIF) [2.58.56.77]:63558: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:57:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:57:12 dovecot_login authenticator failed for H=(fYycKWI) [158.94.208.175]:58400: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:57:10 dovecot_login authenticator failed for H=(MDEjQ4GMF) [91.92.240.235]:65103: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:57:02 dovecot_login authenticator failed for H=(qoAaBf7) [2.58.56.77]:56809: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:58:07 dovecot_login authenticator failed for H=(0wZ7bfsFT) [2.58.56.77]:55520: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:58:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49963: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:58:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.70.164
country_id: 1269750
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:71197.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71d62a7690ff1291f4b0eb2473bba2c6fcef34fa||Title:0x8379c7ba||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:58:45 dovecot_login authenticator failed for H=(kyQxW8) [91.92.240.235]:56954: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:58:08 dovecot_login authenticator failed for H=(j2jzp7EnpO) [158.94.208.175]:64430: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:59:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:59:12 dovecot_login authenticator failed for H=(d3phfd4) [2.58.56.77]:54817: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:59:14 dovecot_login authenticator failed for H=(K0Eg1JAER8) [91.92.240.235]:54667: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:59:08 dovecot_login authenticator failed for H=(CLVIMp3) [158.94.208.175]:58997: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.146.19.89
country_id: 1694008
domain: fimco.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53676.fimco.com.my||ServerName:fimco.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4eab999de35a73ce189a9ee6d52c1aaf7894d05||Title:0xa5c105c4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:59:27 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57813: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:00:10 dovecot_login authenticator failed for H=(HZwjJFqps) [158.94.208.175]:49874: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:00:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:00:20 dovecot_login authenticator failed for H=(oaPbmd0) [2.58.56.77]:62275: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:00:03 dovecot_login authenticator failed for H=(jfNRkyZ) [158.94.208.175]:59813: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.138.205
country_id: 6252001
description:
[2026-01-31 19:01:03 +0800] info [cpaneld] 71.203.138.205 - cofreth "GET /login/?login_only=1&user=cofreth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.195.115.128
country_id: 6252001
description:
[2026-01-31 19:01:17 +0800] info [cpaneld] 68.195.115.128 - cofrethcomm "GET /login/?login_only=1&user=cofrethcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcomm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:01:05 dovecot_login authenticator failed for H=(zEXk5t8L) [2.58.56.77]:50024: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.42.21.161
country_id: 6252001
description:
[2026-01-31 19:01:33 +0800] info [cpaneld] 47.42.21.161 - cofret "GET /login/?login_only=1&user=cofret&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofret (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.197.64.180
country_id: 6252001
description:
[2026-01-31 19:01:48 +0800] info [cpaneld] 98.197.64.180 - cof "GET /login/?login_only=1&user=cof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cof (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:01:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51042: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:01:08 dovecot_login authenticator failed for H=(JZGUZScP) [158.94.208.175]:50065: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.124.191.250
country_id: 6252001
description:
[2026-01-31 19:01:15 +0800] info [cpaneld] 172.124.191.250 - cofrethcommy "GET /login/?login_only=1&user=cofrethcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcommy (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/autogrea/public_html/images/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.206.146.87
country_id: 6252001
description:
[2026-01-31 19:01:41 +0800] info [cpaneld] 68.206.146.87 - cofr "GET /login/?login_only=1&user=cofr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofr (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.139.29
country_id: 2658434
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/autogrea/public_html/assets||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.153.126.153
country_id: 6252001
description:
[2026-01-31 19:01:20 +0800] info [cpaneld] 24.153.126.153 - cofrethcom "GET /login/?login_only=1&user=cofrethcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.34.174.155
country_id: 6252001
description:
[2026-01-31 19:01:24 +0800] info [cpaneld] 100.34.174.155 - cofrethco "GET /login/?login_only=1&user=cofrethco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.119.126.183
country_id: 6252001
description:
[2026-01-31 19:01:30 +0800] info [cpaneld] 24.119.126.183 - cofrethc "GET /login/?login_only=1&user=cofrethc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.222.123.253
country_id: 6252001
description:
[2026-01-31 19:01:36 +0800] info [cpaneld] 108.222.123.253 - cofre "GET /login/?login_only=1&user=cofre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofre (has_cpuser_file failed)


plugin: modsec
rule: 77142124
name: IM360 WAF: T rack WordPress registration flood
abuser: 160.250.133.80
country_id: 1562822
domain: eminent.st
description:
IM360 WAF: T  rack WordPress registration flood||WPU:||RSV:7.71||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:02:11 dovecot_login authenticator failed for H=(f9UiBDP) [158.94.208.175]:54745: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:02:08 dovecot_login authenticator failed for H=(99Yh49r0) [2.58.56.77]:53792: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-01-31 19:02:35 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:52808: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.139.29
country_id: 2658434
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/autogrea/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2026-01-31 19:02:50 dovecot_login authenticator failed for H=(nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:45032: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 19:02:24 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:54100: 535 Incorrect authentication data (set_id=enquiry@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:03:13 dovecot_login authenticator failed for H=(v7fcBxDT4G) [2.58.56.77]:52943: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:03:04 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:24164: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:03:13 dovecot_login authenticator failed for H=(y3Wycnw) [158.94.208.175]:53645: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-31 19:03:08 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:56751: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 19:03:34 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:43046: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/career.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2026-01-31 19:03:25 dovecot_login authenticator failed for H=([149.54.15.42]) [149.54.15.42]:39656: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-31 19:03:34 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:47270: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-01-31 19:03:02 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:10107: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 19:04:25 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:50476: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:04:30 dovecot_login authenticator failed for H=(jSx4qoR12) [158.94.208.175]:62098: 535 Incorrect authentication data (set_id=rosliza)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.37.219
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-area.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-31 19:04:02 dovecot_login authenticator failed for H=([60.8.73.174]) [60.8.73.174]:16718: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.3.236
country_id: 1835841
description:
2026-01-31 19:04:43 dovecot_login authenticator failed for H=(localhost) [49.246.3.236]:58768: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-31 19:04:48 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:35324: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-31 19:04:52 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:48816: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2026-01-31 19:04:55 dovecot_login authenticator failed for H=([85.117.232.42]) [85.117.232.42]:36262: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:04:20 dovecot_login authenticator failed for H=(E6jENM) [2.58.56.77]:60838: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 19:05:59 dovecot_login authenticator failed for H=([182.79.70.225]) [182.95.230.134]:41278: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-31 19:06:01 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:55150: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:05:02 dovecot_login authenticator failed for H=(N91aOB1xA) [2.58.56.77]:64955: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:05:08 dovecot_login authenticator failed for H=(03NLd1) [158.94.208.175]:63254: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:05:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:05:23 dovecot_login authenticator failed for H=(fhqGZe) [2.58.56.77]:60693: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 19:05:25 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:48494: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2026-01-31 19:05:51 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.231.106]:49543: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-01-31 19:05:57 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:38759: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-31 19:05:11 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:58540: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 19:06:23 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:34100: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.92.45
country_id: 1655842
description:
2026-01-31 19:06:39 dovecot_login authenticator failed for H=([115.84.92.45]) [115.84.92.45]:34938: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:06:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2026-01-31 19:06:25 dovecot_login authenticator failed for H=([112.162.18.150]) [112.162.18.150]:52557: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:06:46 H=([167.148.167.71]) [167.148.167.71]:51248 F=<Support@ajplantations.com.my> rejected RCPT <kasim_kn@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:06:52 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:42124: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:06:02 dovecot_login authenticator failed for H=(TWGgXDHj) [2.58.56.77]:60454: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-31 19:06:08 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:46872: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2026-01-31 19:06:35 dovecot_login authenticator failed for H=(14.12.168.188.retail.ttk.ru) [188.168.12.14]:56152: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:06:05 dovecot_login authenticator failed for H=(q5aukpcvi) [158.94.208.175]:63711: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:07:02 dovecot_login authenticator failed for H=(paETvUB) [2.58.56.77]:58764: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 19:07:44 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:38192: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:07:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50775: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/astlogc/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:07:14 dovecot_login authenticator failed for H=(XwX32y) [158.94.208.175]:52975: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:07:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-31 19:07:26 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:32648: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:08:15 dovecot_login authenticator failed for H=(Ufm29Q3xEy) [158.94.208.175]:51681: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:08:40 dovecot_login authenticator failed for H=(8L3jeYw) [158.94.208.175]:57384: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.42
country_id: 690791
description:
2026-01-31 19:08:17 dovecot_login authenticator failed for H=(ADMIN) [84.239.42.42]:29158: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:08:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:65245: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/dpscomsec/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:08:09 dovecot_login authenticator failed for H=(XZcwYj24y) [2.58.56.77]:62493: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 19:08:06 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:41550: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:09:15 dovecot_login authenticator failed for H=(Po0j3b) [2.58.56.77]:56623: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-31 19:09:02 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:50007: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:09:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-31 19:09:12 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:52066: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:09:21 dovecot_login authenticator failed for H=(K797WBIx) [158.94.208.175]:56496: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:10:19 dovecot_login authenticator failed for H=(EZJOvRqxoM) [2.58.56.77]:57252: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.112.101.42
country_id: 2328926
domain: fkr.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59387.fkr.com.my||ServerName:fkr.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77bf3bf3650260a12ab4e0c7798e6bc2f308cef0||Title:0x08384354||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:10:20 dovecot_login authenticator failed for H=(TaaD2b) [158.94.208.175]:64001: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-31 19:11:40 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:45124: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:11:18 dovecot_login authenticator failed for H=(CrNUyht3R6) [158.94.208.175]:59812: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-31 19:11:42 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:22620: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 19:11:53 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:27382: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.147.63
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/clients.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:11:21 dovecot_login authenticator failed for H=(kRrdoQEHbj) [2.58.56.77]:63024: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-31 19:11:24 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:23218: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 19:12:00 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:56232: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-01-31 19:11:29 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:55612: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:11:59 H=([167.148.167.71]) [167.148.167.71]:49315 F=<Support@tujusetia.my> rejected RCPT <kokfoh.liau@tujusetia.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home/oxboldc/public_html/images/class.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:12:02 dovecot_login authenticator failed for H=(0EaUcVKP) [2.58.56.77]:62112: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.255.239
country_id: 1814991
description:
2026-01-31 19:12:21 dovecot_login authenticator failed for H=([117.69.255.239]) [117.69.255.239]:43490: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-31 19:12:20 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:41185: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:12:24 dovecot_login authenticator failed for H=(rVgPrXqSR) [158.94.208.175]:65380: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-31 19:12:31 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:49878: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-01-31 19:12:33 dovecot_login authenticator failed for H=(nsg-corporate-129.168.187.122.airtel.in) [125.19.163.58]:34714: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:12:51 dovecot_login authenticator failed for H=(TKswqz) [158.94.208.175]:58431: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 13.75.54.243
country_id: 1819730
domain: oxbold.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/oxboldc/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:13:07 dovecot_login authenticator failed for H=(eRYxRHwp) [2.58.56.77]:54094: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:13:17 dovecot_login authenticator failed for H=(kx2PAz) [158.94.208.175]:55485: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.94.121.82
country_id: 1835841
description:
2026-01-31 19:13:34 dovecot_login authenticator failed for H=([115.94.121.82]) [115.94.121.82]:35849: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.94.254.29
country_id: 617790
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/advertise.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:13:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:14:28 dovecot_login authenticator failed for H=(renjjkfT) [158.94.208.175]:53383: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-01-31 19:14:09 dovecot_login authenticator failed for H=([1.237.155.150]) [1.237.155.150]:45780: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.25.254
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/exhibition.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:14:13 dovecot_login authenticator failed for H=(Cg9mh0) [2.58.56.77]:62536: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.203.24
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
country_id: 1814991
description:
2026-01-31 19:14:06 dovecot_login authenticator failed for H=([183.167.217.86]) [183.167.217.86]:51021: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-31 19:14:41 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:51868: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:15:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:15:35 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58408: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:15:20 dovecot_login authenticator failed for H=(2FvLlmWlKM) [2.58.56.77]:57915: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:15:17 dovecot_login authenticator failed for H=(gTldomTJq) [158.94.208.175]:59297: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:16:48 dovecot_login authenticator failed for H=(KavV4D) [158.94.208.175]:52422: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:16:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.131
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/facilities.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:16:24 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52071: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:16:03 dovecot_login authenticator failed for H=(U9wc3R) [158.94.208.175]:64899: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:16:09 dovecot_login authenticator failed for H=(ZoPSpKXF) [2.58.56.77]:59125: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.177
country_id: 2186224
description:
2026-01-31 19:17:12 dovecot_login authenticator failed for H=([121.73.163.177]) [121.73.163.177]:55208: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-31 19:17:27 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:56722: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:17:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 19:17:46 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:59485: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:17:15 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:53086: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:17:08 dovecot_login authenticator failed for H=(QbPneJQ2) [158.94.208.175]:54252: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:17:56 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54505: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:17:15 dovecot_login authenticator failed for H=(QoDVULEKt) [2.58.56.77]:55609: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:18:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57090: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:18:03 dovecot_login authenticator failed for H=(3ATkHJk) [158.94.208.175]:65151: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.118.42
country_id: 2921044
description:
2026-01-31 19:18:24 dovecot_plain authenticator failed for H=vps-249871a3.vps.ovh.net (WIN-A2HH3EVVM7G.openstacklocal) [57.129.118.42]:51031: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:18:26 dovecot_login authenticator failed for H=(H4HYdHmpk) [2.58.56.77]:52907: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.191.243.91
country_id: 1814991
description:
2026-01-31 19:18:55 dovecot_login authenticator failed for H=([222.191.243.91]) [222.191.243.91]:42530: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:18:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.113.24
country_id: 3865483
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/history.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 19:18:34 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:58829: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-01-31 19:18:59 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:52405: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-31 19:18:16 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:54576: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-31 19:18:03 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:51042: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:19:48 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62891: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:19:01 dovecot_login authenticator failed for H=(PgtX2Lm) [158.94.208.175]:56098: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:19:10 dovecot_login authenticator failed for H=(DL4aHA) [2.58.56.77]:54161: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:19:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52461: 535 Incorrect authentication data (set_id=testing@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2026-01-31 19:19:10 dovecot_login authenticator failed for H=([153.37.177.219]) [153.37.177.219]:43228: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.34.131
country_id: 1835841
domain: vmsmotorsports.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/vmsadmin/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 19:20:53 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:35529: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:20:11 dovecot_login authenticator failed for H=(xy8dqsb6Wn) [158.94.208.175]:63144: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:20:18 dovecot_login authenticator failed for H=(03atxcEw3d) [2.58.56.77]:51767: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:20:55 dovecot_login authenticator failed for H=(dnS5cW9) [178.16.54.22]:60301: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.247.7.83
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=24461515983341 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 19:20:34 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:36428: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:21:03 dovecot_login authenticator failed for H=(XBTlSkRN) [2.58.56.77]:56183: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:21:17 dovecot_login authenticator failed for H=(fAwqYl) [158.94.208.175]:61461: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-31 19:21:22 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:32985: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:21:24 dovecot_login authenticator failed for H=(O6SqVlEa) [178.16.54.22]:58542: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:22:11 dovecot_login authenticator failed for H=(vQQtwGhlw) [2.58.56.77]:64395: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/gagasanteguhcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:22:03 dovecot_login authenticator failed for H=(VSlMujMS) [158.94.208.175]:56683: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:22:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:22:42 dovecot_login authenticator failed for H=(khYk8N9EL) [178.16.54.22]:61537: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:23:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:23:14 dovecot_login authenticator failed for H=(AGoDRbtJxz) [2.58.56.77]:61218: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:23:33 dovecot_login authenticator failed for H=(BFPm2x8) [178.16.54.22]:54998: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 19:23:44 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:53870: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:23:08 dovecot_login authenticator failed for H=(OMSXYwL4e) [158.94.208.175]:52617: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.179
country_id: 1269750
description:
2026-01-31 19:23:15 dovecot_login authenticator failed for H=([103.146.233.179]) [103.146.233.179]:59341: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-31 19:23:04 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:49700: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:23:08 dovecot_login authenticator failed for H=(Uoi7yY) [158.94.208.175]:60035: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-31 19:23:53 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:40491: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 19:23:32 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:41050: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2026-01-31 19:23:44 dovecot_login authenticator failed for H=([103.230.176.152]) [103.230.176.152]:46826: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 19:24:59 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:59660: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:24:02 dovecot_login authenticator failed for H=(ps8Oay) [178.16.54.22]:57235: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:24:06 dovecot_login authenticator failed for H=(a7hSz1) [2.58.56.77]:59395: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.228.203
country_id: 1861060
domain: mail.empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/empi7862/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 19:24:55 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:33410: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:24:18 dovecot_login authenticator failed for H=(vGYjIyMLJM) [158.94.208.175]:59397: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:24:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60091: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:25:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57325: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:25:03 dovecot_login authenticator failed for H=(kChydTzZh) [158.94.208.175]:50043: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:25:12 dovecot_login authenticator failed for H=(CYbtBa) [2.58.56.77]:63089: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:25:19 dovecot_login authenticator failed for H=(T9Z8ShLAh) [178.16.54.22]:64358: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 19:25:40 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:43958: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:26:16 dovecot_login authenticator failed for H=(hXBeq83) [178.16.54.22]:50935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:26:01 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:25120: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2026-01-31 19:26:06 dovecot_login authenticator failed for H=([49.124.153.31]) [49.124.153.31]:38634: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:26:19 dovecot_login authenticator failed for H=(rlQz4r) [2.58.56.77]:64271: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 19:26:56 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:12060: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.124
country_id: 1668284
description:
2026-01-31 19:26:16 dovecot_login authenticator failed for H=111-70-32-124.emome-ip.hinet.net [111.70.32.124]:37067: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:26:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58234: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-31 19:26:21 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:51345: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:26:23 dovecot_login authenticator failed for H=(5Y64Wd2J2f) [158.94.208.175]:63976: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 19:26:24 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52962: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-01-31 19:26:26 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net [111.70.41.88]:51491: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.141.104
country_id: 99237
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:26:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64306: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:27:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 19:27:56 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:58672: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:27:04 dovecot_login authenticator failed for H=(7HVPCav2eV) [2.58.56.77]:56123: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:27:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62080: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:27:06 dovecot_login authenticator failed for H=(I2t3OUu7) [178.16.54.22]:52679: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:27:09 dovecot_login authenticator failed for H=(Md7OEzu5e) [158.94.208.175]:61448: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:28:05 dovecot_login authenticator failed for H=(4oMhQIB) [158.94.208.175]:63769: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:28:06 dovecot_login authenticator failed for H=(Pa4AF2) [2.58.56.77]:50969: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-31 19:28:43 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:39734: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:28:03 dovecot_login authenticator failed for H=(4UOiFriGIH) [178.16.54.22]:59007: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-31 19:28:22 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:56050: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 19:28:57 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:24882: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:28:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:29:11 dovecot_login authenticator failed for H=(o3LA6dx) [2.58.56.77]:58245: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-31 19:29:43 dovecot_login authenticator failed for H=(78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:37884: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.240
country_id: 2186224
description:
2026-01-31 19:29:47 dovecot_login authenticator failed for H=([121.73.168.240]) [121.73.168.240]:53378: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 19:29:29 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:33638: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.190.195.22
country_id: 6252001
description:
[2026-01-31 19:29:47 +0800] info [cpaneld] 184.190.195.22 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:29:02 dovecot_login authenticator failed for H=(vZNI65zzNW) [178.16.54.22]:61015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-31 19:29:21 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:44644: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.156.130.34
country_id: 1269750
description:
2026-01-31 19:29:22 dovecot_login authenticator failed for H=([103.140.18.186]) [49.156.130.34]:47946: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.210.134.164
country_id: 6252001
description:
[2026-01-31 19:29:26 +0800] info [cpaneld] 71.210.134.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.3.26
country_id: 6252001
description:
[2026-01-31 19:29:40 +0800] info [cpaneld] 172.58.3.26 - cabec "GET /login/?login_only=1&user=cabec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.204.22.225
country_id: 6252001
description:
[2026-01-31 19:29:43 +0800] info [cpaneld] 47.204.22.225 - cab "GET /login/?login_only=1&user=cab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cab (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.151.178
country_id: 6252001
description:
[2026-01-31 19:29:21 +0800] info [cpaneld] 172.56.151.178 - cabe "GET /login/?login_only=1&user=cabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.198.32.143
country_id: 6252001
description:
[2026-01-31 19:29:28 +0800] info [cpaneld] 68.198.32.143 - cabecommy "GET /login/?login_only=1&user=cabecommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabecommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.147.138.173
country_id: 6252001
description:
[2026-01-31 19:29:36 +0800] info [cpaneld] 35.147.138.173 - cabeco "GET /login/?login_only=1&user=cabeco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabeco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:29:23 dovecot_login authenticator failed for H=(KLAXYksxr7) [158.94.208.175]:51721: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.40.106
country_id: 6252001
description:
[2026-01-31 19:29:31 +0800] info [cpaneld] 76.36.40.106 - cabecomm "GET /login/?login_only=1&user=cabecomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabecomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.106.220.146
country_id: 6252001
description:
[2026-01-31 19:29:33 +0800] info [cpaneld] 68.106.220.146 - cabecom "GET /login/?login_only=1&user=cabecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:30:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:30:22 dovecot_login authenticator failed for H=(9sTQTDE) [178.16.54.22]:64986: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:30:22 dovecot_login authenticator failed for H=(oqDs3B) [158.94.208.175]:57209: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:30:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49187: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 19:30:59 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:35562: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 19:30:04 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:38362: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.31
country_id: 99237
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=785897 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-01-31 19:30:03 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:49800: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:30:12 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:43734: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:30:16 dovecot_login authenticator failed for H=(Qg9SvDssO) [2.58.56.77]:53781: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.97.118.110
country_id: 2589581
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=255888 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-31 19:30:06 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:40374: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:30:43 dovecot_login authenticator failed for H=(WnEK1M3) [158.94.208.175]:54017: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:31:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64982: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:31:24 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:55682: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:31:06 dovecot_login authenticator failed for H=(fam9PHE) [158.94.208.175]:60331: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:31:02 dovecot_login authenticator failed for H=(CkuO2bjT) [2.58.56.77]:61545: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.229.105
country_id: 2077456
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wing/10/88/1041360 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:31:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.173.227
country_id: 2017370
description:
2026-01-31 19:31:50 dovecot_login authenticator failed for H=([109.202.173.227]) [109.202.173.227]:33344: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:32:14 dovecot_login authenticator failed for H=(F0scVF9JF2) [158.94.208.175]:57919: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:32:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51471: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:32:39 H=([167.148.167.71]) [167.148.167.71]:55941 F=<Support@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:32:08 dovecot_login authenticator failed for H=(7fhsqh4) [2.58.56.77]:63350: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-01-31 19:32:48 dovecot_login authenticator failed for H=([103.147.248.23]) [103.147.248.23]:54890: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.209.179.31
country_id: 1269750
description:
2026-01-31 19:32:03 dovecot_login authenticator failed for H=([103.209.179.31]) [103.209.179.31]:5427: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:32:13 dovecot_login authenticator failed for H=(ahjhnlbS5t) [178.16.54.22]:50109: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-01-31 19:32:48 dovecot_plain authenticator failed for H=(bendown) [65.20.143.159]:47768: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 19:33:03 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:43288: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:33:16 dovecot_login authenticator failed for H=(4KO7Lv) [158.94.208.175]:53358: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 19:33:41 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:44080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 19:33:51 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:34166: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:33:10 dovecot_login authenticator failed for H=(5DEBUzX) [178.16.54.22]:56784: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:33:17 dovecot_login authenticator failed for H=(w5HU9XA) [2.58.56.77]:57662: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 19:33:27 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:36174: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:34:35 dovecot_login authenticator failed for H=(6jmz67b) [178.16.54.22]:61511: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:34:55 dovecot_login authenticator failed for H=(pm4FP0) [45.94.31.131]:64162: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:34:06 dovecot_login authenticator failed for H=(UvF8Xq) [158.94.208.175]:63776: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 19:34:07 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:35847: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:34:17 dovecot_login authenticator failed for H=(F3Yz07veLM) [158.94.208.175]:62488: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:34:26 dovecot_login authenticator failed for H=(tNH2sV3) [2.58.56.77]:63919: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 19:35:49 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:52576: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:35:18 dovecot_login authenticator failed for H=(o0Ixp0Ql) [2.58.56.77]:54515: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:35:24 dovecot_login authenticator failed for H=(SBVaL5Mq) [158.94.208.175]:51729: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:35:04 dovecot_login authenticator failed for H=(jQckm1) [45.94.31.131]:57734: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:35:03 dovecot_login authenticator failed for H=(pO9KyzID) [178.16.54.22]:60935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:36:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 19:36:21 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:46504: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.91.102.183
country_id: 2328926
domain: www.u-net.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:102.91.102.183||TA:102.91.102.183||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:36:25 dovecot_login authenticator failed for H=(n61nJY3W) [178.16.54.22]:61682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:36:17 dovecot_login authenticator failed for H=(mwiBhR) [45.94.31.131]:56319: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:36:05 dovecot_login authenticator failed for H=(j99IF7R) [2.58.56.77]:49732: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 19:36:11 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:58324: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:36:14 dovecot_login authenticator failed for H=(12hippW) [158.94.208.175]:55511: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 19:37:56 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:38580: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:37:34 dovecot_login authenticator failed for H=(MtFExKbhR6) [158.94.208.175]:54540: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:37:45 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57986: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:37:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 19:37:16 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:37064: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 19:37:41 dovecot_login authenticator failed for H=([122.187.229.168]) [122.187.229.168]:59678: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:37:15 dovecot_login authenticator failed for H=(vP8Ptv) [178.16.54.22]:50006: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:37:25 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64258: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:37:18 dovecot_login authenticator failed for H=(pnnG0uL8Jp) [2.58.56.77]:51321: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:37:22 dovecot_login authenticator failed for H=(4JTr6UjmAX) [158.94.208.175]:59209: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:37:44 H=([167.148.167.71]) [167.148.167.71]:56700 F=<Support@ms-chemicals.net> rejected RCPT <miko@ms-chemicals.net>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:37:16 dovecot_login authenticator failed for H=(LVK89GCz) [45.94.31.131]:59448: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:37:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 19:37:46 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:52008: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:38:07 dovecot_login authenticator failed for H=(TnvX66L) [158.94.208.175]:49635: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:38:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:38:14 dovecot_login authenticator failed for H=(LURNuAf) [45.94.31.131]:55829: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:38:34 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50407: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.113
country_id: 2661886
description:
2026-01-31 19:38:52 dovecot_login authenticator failed for H=(ADMIN) [46.246.8.113]:50342: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:38:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:38:05 dovecot_login authenticator failed for H=(sc0FdX) [2.58.56.77]:52909: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:38:07 dovecot_login authenticator failed for H=(GCaLCF) [178.16.54.22]:60022: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:38:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64049: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 19:38:34 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.49.14]:41990: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 19:38:55 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47466: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:39:15 dovecot_login authenticator failed for H=(c2rDtWidaq) [158.94.208.175]:56705: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.30.124.96
country_id: 1814991
description:
2026-01-31 19:39:26 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [111.30.124.96]:15067: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:39:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52807: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:39:12 dovecot_login authenticator failed for H=(mr4scj) [45.94.31.131]:54754: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:39:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:39:14 dovecot_login authenticator failed for H=(MjoyOay) [2.58.56.77]:57956: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-01-31 19:39:21 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:59194: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:39:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:39:04 dovecot_login authenticator failed for H=(9TxqU4) [178.16.54.22]:53848: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 43.251.253.53
country_id: 1168579
domain: gagasanteguh.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:79477.gagasanteguh.com.my||ServerName:gagasanteguh.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81b1fc9881ab32d4a0b936196b02e3b11e1b908f||Title:0xf2a4420e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:39:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 19:39:46 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:50026: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 19:40:50 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:51888: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:40:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-01-31 19:40:17 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:56930: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:40:10 dovecot_login authenticator failed for H=(1zgClFHTc) [45.94.31.131]:53431: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:40:15 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:33078: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:40:44 dovecot_login authenticator failed for H=(Awd8o4) [178.16.54.22]:49442: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:40:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:40:25 dovecot_login authenticator failed for H=(eGwcY96W) [158.94.208.175]:57773: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.247
country_id: 1733045
description:
2026-01-31 19:40:29 dovecot_login authenticator failed for H=([49.124.150.247]) [49.124.150.247]:50492: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:40:20 dovecot_login authenticator failed for H=(QJ4QLFnNFZ) [2.58.56.77]:55160: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:40:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 19:42:00 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:37144: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:41:55 dovecot_login authenticator failed for H=(bPaPdTEEO7) [178.16.54.22]:63503: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.193
country_id: 1733045
description:
2026-01-31 19:41:41 dovecot_login authenticator failed for H=([49.124.159.193]) [49.124.159.193]:40592: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.234.188
country_id: 953987
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2300 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 19:41:03 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:58830: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:41:05 dovecot_login authenticator failed for H=(c6T324) [2.58.56.77]:63876: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:41:07 dovecot_login authenticator failed for H=(UtNOUi) [45.94.31.131]:52063: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:41:33 dovecot_login authenticator failed for H=(xmiwmmf68X) [158.94.208.175]:59479: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:41:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:41:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:42:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:42:08 dovecot_login authenticator failed for H=(HQymE0LB) [45.94.31.131]:62629: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:42:13 dovecot_login authenticator failed for H=(iz8Jeg) [2.58.56.77]:55909: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:42:19 dovecot_login authenticator failed for H=(Hgbd5r) [178.16.54.22]:63535: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 19:42:46 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:47914: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:42:06 dovecot_login authenticator failed for H=(mNepiHMrYg) [158.94.208.175]:58688: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:42:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.206.101.240
country_id: 2017370
description:
2026-01-31 19:42:13 dovecot_login authenticator failed for H=(pool-5-206-101-240.is74.ru) [5.206.101.240]:58586: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-31 19:42:24 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:38546: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:42:35 dovecot_login authenticator failed for H=(Aw24Mt9p) [158.94.208.175]:52862: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:43:06 dovecot_login authenticator failed for H=(m42Lt8) [45.94.31.131]:64469: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:43:19 dovecot_login authenticator failed for H=(wouIJN) [2.58.56.77]:60009: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:43:56 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55627: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:43:08 dovecot_login authenticator failed for H=(lTZzx8LDY4) [178.16.54.22]:51952: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:43:40 H=([167.148.167.71]) [167.148.167.71]:51310 F=<Support@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:43:03 dovecot_login authenticator failed for H=(u4EWdG8kY) [158.94.208.175]:62150: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:44:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60511: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-31 19:44:14 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:48870: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:44:15 dovecot_login authenticator failed for H=(I8GhCkjQ) [158.94.208.175]:64832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 19:44:40 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:47610: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:44:01 dovecot_login authenticator failed for H=(dpBBvjXY1I) [178.16.54.22]:53681: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:45:00 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:52996: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:44:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 19:44:23 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:51256: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:44:03 dovecot_login authenticator failed for H=(Z4ZKOJmL) [2.58.56.77]:61677: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:44:04 dovecot_login authenticator failed for H=(rMG3WGh7mD) [45.94.31.131]:63858: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:45:21 dovecot_login authenticator failed for H=(hRpT8kP0) [45.94.31.131]:53110: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:45:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-31 19:45:37 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (quinacran) [73.188.252.208]:41438: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 19:45:41 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59822: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 19:45:50 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:44004: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-01-31 19:45:26 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:65500: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:45:27 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:50285: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:45:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52276: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 19:45:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (etranic) [87.103.126.54]:23252: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:45:32 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60513: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 19:45:19 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:49466: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:45:20 dovecot_login authenticator failed for H=(y3knysB6A9) [178.16.54.22]:59780: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fimco/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:45:09 dovecot_login authenticator failed for H=(REvx4kAf) [2.58.56.77]:51456: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:45:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:45:07 dovecot_login authenticator failed for H=(KJRldw2hG8) [158.94.208.175]:49512: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-31 19:46:21 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:58588: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:46:21 dovecot_login authenticator failed for H=(P3RnP48) [2.58.56.77]:64686: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:46:19 dovecot_login authenticator failed for H=(rtXAvY1S) [45.94.31.131]:64335: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:46:57 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55060: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 19:46:01 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:44484: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-31 19:46:06 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:64614: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: aircarbonic.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/aircarbonicadmin/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.39
country_id: 1269750
description:
2026-01-31 19:46:11 dovecot_login authenticator failed for H=([117.248.201.39]) [117.248.201.39]:36589: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:46:10 dovecot_login authenticator failed for H=(EihIqq) [178.16.54.22]:51113: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:46:04 dovecot_login authenticator failed for H=(T8o34e) [158.94.208.175]:54357: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:46:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-31 19:46:48 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:56480: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:47:27 dovecot_login authenticator failed for H=(SameqO) [178.16.54.22]:60835: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:47:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:47:07 dovecot_login authenticator failed for H=(LOkdnctv) [158.94.208.175]:51122: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:47:09 dovecot_login authenticator failed for H=(CFcWSHJiSF) [2.58.56.77]:51364: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.241.82
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:47:17 dovecot_login authenticator failed for H=(LGyIHb2p) [45.94.31.131]:54874: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:48:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.85.10
country_id: 1819730
domain: mams1.manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/manfotp3/mams1.manforce.net/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2026-01-31 19:48:33 dovecot_login authenticator failed for H=(gatecidos.static.gvt.net.br) [179.185.29.233]:39575: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-31 19:48:35 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:58834: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:48:49 dovecot_login authenticator failed for H=(TJebS7b) [158.94.208.175]:50039: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:48:52 sv3 pure-ftpd[209957]: (?@112.201.131.115) [WARNING] Authentication failed for user [inf@cordage.com.my]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:48:01 dovecot_login authenticator failed for H=(XWjBl58) [158.94.208.175]:56070: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:48:14 dovecot_login authenticator failed for H=(FY458ucJ) [45.94.31.131]:56548: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-31 19:48:41 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:40752: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:48:45 sv3 pure-ftpd[209957]: (?@112.201.131.115) [INFO] New connection from 112.201.131.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:49:00 dovecot_login authenticator failed for H=(CjeZkdgm) [178.16.54.22]:53334: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:48:16 dovecot_login authenticator failed for H=(5AamBwQQcR) [2.58.56.77]:49518: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-31 19:48:26 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:35614: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 19:49:01 50633 [Warning] Aborted connection 50633 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:06 sv3 pure-ftpd[210052]: (?@112.201.131.115) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:49:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:49:14 dovecot_login authenticator failed for H=(I0FHk9Cs0) [158.94.208.175]:60942: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 19:49:41 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:57912: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:49:47 dovecot_login authenticator failed for H=(Qi0rhkmszv) [178.16.54.22]:50612: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.235.177.217
country_id: 1694008
domain: garudabay.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:62550.garudabay.com||ServerName:garudabay.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa0e450aebd876d652ac1a379debd45fa5ff96ce||Title:0xa5988c83||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:49:12 dovecot_login authenticator failed for H=(fDFHdhqeFy) [45.94.31.131]:62627: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:07 sv3 pure-ftpd[210112]: (?@112.201.131.115) [INFO] New connection from 112.201.131.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:49:09 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64324: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:49:14 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:41967: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:44 sv3 pure-ftpd[210487]: (?@112.201.131.115) [INFO] New connection from 112.201.131.115


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:49:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:49:02 dovecot_login authenticator failed for H=(OaJ4UUE) [2.58.56.77]:61513: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:43 sv3 pure-ftpd[210331]: (?@112.201.131.115) [WARNING] Authentication failed for user [inf]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:50:01 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:41027: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:50:14 dovecot_login authenticator failed for H=(DBsvU6R) [2.58.56.77]:56819: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 19:50:23 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:51148: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-01-31 19:50:36 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:55332: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-31 19:50:51 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:49202: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:51:00 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60714: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:50:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:50:11 dovecot_login authenticator failed for H=(7E4XzV) [158.94.208.175]:64718: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:50:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56455: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:50:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:50:09 dovecot_login authenticator failed for H=(9l2VGWx) [45.94.31.131]:52157: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.51.64
country_id: 2017370
description:
2026-01-31 19:50:28 dovecot_login authenticator failed for H=(n51-h64.smr-rsk.metromax.ru) [81.22.51.64]:49752: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.251.82
country_id: 2017370
description:
2026-01-31 19:51:29 dovecot_login authenticator failed for H=([79.135.251.82]) [79.135.251.82]:55314: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:51:07 dovecot_login authenticator failed for H=(0TpvSDP9w) [45.94.31.131]:58798: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2026-01-31 19:51:07 dovecot_login authenticator failed for H=([125.154.62.229]) [125.154.62.229]:42976: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-01-31 19:51:37 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:53422: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-31 19:51:37 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:50601: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:51:09 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:38616: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:51:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 19:51:18 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:57511: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:51:16 dovecot_login authenticator failed for H=(4IQgiNW3) [2.58.56.77]:53094: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:51:42 dovecot_login authenticator failed for H=(R8eqZjFV) [178.16.54.22]:50242: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:51:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51030: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-31 19:51:24 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:50288: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:51:19 dovecot_login authenticator failed for H=(CAcqKApuEL) [158.94.208.175]:53446: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 19:51:20 50731 [Warning] Aborted connection 50731 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2026-01-31 19:51:21 +0800] info [webmaild] 85.215.116.20 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:51:50 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:41279: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:51:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62323: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.84.70
country_id: 2017370
description:
2026-01-31 19:51:31 dovecot_login authenticator failed for H=(95-165-84-70.dynamic.spd-mgts.ru) [95.165.84.70]:51158: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:52:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55007: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:52:03 dovecot_login authenticator failed for H=(o1a5pNCiNh) [158.94.208.175]:57294: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:52:23 dovecot_login authenticator failed for H=(LzDBKz) [2.58.56.77]:52978: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:52:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:52:22 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:39591: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:52:08 dovecot_login authenticator failed for H=(4rlDKSduS) [45.94.31.131]:49879: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 19:52:25 50756 [Warning] Aborted connection 50756 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:52:32 dovecot_login authenticator failed for H=(4bK6GP) [178.16.54.22]:60368: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 19:52:59 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:45972: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:53:09 dovecot_login authenticator failed for H=(2hGAnH) [2.58.56.77]:56001: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 152.42.183.182
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/kimmark/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:53:06 dovecot_login authenticator failed for H=(yfMpMYDpaS) [45.94.31.131]:62636: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-31 19:53:41 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:57262: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:53:09 dovecot_login authenticator failed for H=(kk1hW6pZYI) [158.94.208.175]:54558: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 152.42.183.182
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/kimmark/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:53:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-01-31 19:53:52 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:54852: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:54:12 dovecot_login authenticator failed for H=(dJ4Ikc) [178.16.54.22]:60597: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-31 19:54:02 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:46941: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:54:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 19:54:26 H=([45.144.212.50]) [45.144.212.50]:60504 F=<ccmsservice@bangkokbank.com> rejected RCPT <info@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:54:14 dovecot_login authenticator failed for H=(Vur0b1) [2.58.56.77]:62776: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:54:04 dovecot_login authenticator failed for H=(OhInoGC) [158.94.208.175]:51755: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:55:08 dovecot_login authenticator failed for H=(m26kWuD) [178.16.54.22]:52212: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:55:14 dovecot_login authenticator failed for H=(i3WtT0) [158.94.208.175]:51227: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:55:23 dovecot_login authenticator failed for H=(js9LcfDe) [2.58.56.77]:64768: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:55:32 dovecot_login authenticator failed for H=(yk4NR6kAmL) [158.94.208.175]:55761: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:56:25 dovecot_login authenticator failed for H=(TXlBH9) [178.16.54.22]:60582: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 19:56:41 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:36608: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:57:01 H=([167.148.167.71]) [167.148.167.71]:52539 F=<Support@euratech.com.my> rejected RCPT <olivia@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:56:07 dovecot_login authenticator failed for H=(tmX5zomQh) [2.58.56.77]:61090: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:56:12 dovecot_login authenticator failed for H=(mw6bQ0Ee4X) [158.94.208.175]:64779: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 19:56:31 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:42806: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.243.5
country_id: 1814991
description:
2026-01-31 19:57:50 dovecot_login authenticator failed for H=([111.75.243.5]) [111.75.243.5]:33628: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:57:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56069: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:57:15 dovecot_login authenticator failed for H=(94l0YDzj) [2.58.56.77]:53234: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:57:32 dovecot_login authenticator failed for H=(Wkk0Xe) [158.94.208.175]:51587: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:57:35 dovecot_login authenticator failed for H=(dIr6RkYo) [178.16.54.22]:53948: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-01-31 19:57:11 dovecot_login authenticator failed for H=([14.40.114.86]) [14.40.114.86]:58082: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:58:47 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52038: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:58:04 dovecot_login authenticator failed for H=(OfissSjb) [158.94.208.175]:63708: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-01-31 19:58:04 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:46646: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:58:06 dovecot_login authenticator failed for H=(SZD9Fp0njA) [178.16.54.22]:57160: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:58:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:58:03 dovecot_login authenticator failed for H=(ryBhjzbG) [2.58.56.77]:50625: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:58:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51000: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.82
country_id: 1269750
description:
2026-01-31 20:00:00 dovecot_login authenticator failed for H=(nsg-corporate-6.249.186.122.airtel.in) [116.193.128.82]:54026: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 19:59:08 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:49784: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:59:09 dovecot_login authenticator failed for H=(Hy5jLd) [2.58.56.77]:52694: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2026-01-31 19:59:18 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [102.132.29.166]:54793: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 19:59:37 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48070: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-31 19:59:28 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:51818: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-01-31 19:59:47 dovecot_login authenticator failed for H=([121.131.220.137]) [121.131.220.137]:45479: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:59:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:59:03 dovecot_login authenticator failed for H=(zRDZUigOo) [158.94.208.175]:56780: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:59:14 dovecot_login authenticator failed for H=(1ZG6isX) [178.16.54.22]:52294: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 20:00:40 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:45531: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:00:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 20:00:36 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:48698: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:00:14 dovecot_login authenticator failed for H=(HeDRDfJ) [158.94.208.175]:51509: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 20:00:15 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:43034: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:00:25 dovecot_login authenticator failed for H=(AVVvPY49hb) [45.94.31.131]:61731: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:00:08 dovecot_login authenticator failed for H=(eY2RL2m) [178.16.54.22]:62251: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.21.246
country_id: 1814991
description:
2026-01-31 20:00:57 dovecot_login authenticator failed for H=([180.165.21.246]) [180.165.21.246]:41242: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:00:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.168.148
country_id: 337996
description:
2026-01-31 20:00:36 dovecot_login authenticator failed for H=([196.188.168.148]) [196.188.168.148]:39752: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:00:15 dovecot_login authenticator failed for H=(gAIB2UKa) [2.58.56.77]:62084: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:01:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:01:23 dovecot_login authenticator failed for H=(dTiXWX) [2.58.56.77]:59669: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-01-31 20:01:34 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:50593: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:01:15 dovecot_login authenticator failed for H=(btf2MVXX) [158.94.208.175]:56876: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.36.223.102
country_id: 1814991
description:
2026-01-31 20:01:23 dovecot_login authenticator failed for H=([103.36.223.102]) [103.36.223.102]:35167: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:01:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 20:01:27 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:58371: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-31 20:01:30 dovecot_login authenticator failed for H=([122.4.199.164]) [122.4.199.164]:51446: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:01:05 dovecot_login authenticator failed for H=(9AdpRSl) [45.94.31.131]:57375: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:01:26 dovecot_login authenticator failed for H=(wNt1mOQXv) [178.16.54.22]:60213: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 20:01:37 H=([45.144.212.50]) [45.144.212.50]:61574 F=<ccmsservice@bangkokbank.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 20:01:42 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:33198: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:02:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 20:02:24 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:52826: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.178.219.31
country_id: 6254930
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/steam/43/451633 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 20:02:12 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:02:15 dovecot_login authenticator failed for H=(KaCcmDSIYh) [178.16.54.22]:55943: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:02:20 dovecot_login authenticator failed for H=(qWGpcL0YuT) [158.94.208.175]:56269: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:02:30 dovecot_login authenticator failed for H=(BoaYMXgEfA) [158.94.208.175]:55589: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:02:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:02:05 dovecot_login authenticator failed for H=(vSRGw7) [45.94.31.131]:61364: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:02:09 dovecot_login authenticator failed for H=(Kz5py6) [2.58.56.77]:49189: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.253.25.216
country_id: 3469034
description:
2026-01-31 20:02:15 dovecot_plain authenticator failed for H=(Q171B58071) [191.253.25.216]:10458: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:03:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:03:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49477: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:03:13 dovecot_login authenticator failed for H=(e6w80U) [2.58.56.77]:51965: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 20:03:56 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:50081: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:03:05 dovecot_login authenticator failed for H=(MDbEyZ) [45.94.31.131]:59146: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-01-31 20:03:40 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:11788: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 20:03:31 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:64263: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:03:13 dovecot_login authenticator failed for H=(OR4BxmpP) [158.94.208.175]:58679: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-31 20:03:13 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:54440: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 20:03:04 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:27116: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-01-31 20:03:06 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:62584: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 20:03:50 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:35114: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-31 20:03:48 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:51628: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:03:05 dovecot_login authenticator failed for H=(YaiwRn3) [178.16.54.22]:64011: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:03:31 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53126: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:04:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56745: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:04:15 dovecot_login authenticator failed for H=(DSt1O3d) [2.58.56.77]:51387: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.165.53.7
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/7888952793.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:04:44 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62148: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:04:38 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55368: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:04:04 dovecot_login authenticator failed for H=(eIzD3Nb) [45.94.31.131]:51674: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:04:26 dovecot_login authenticator failed for H=(PbFwBpuTM) [158.94.208.175]:53524: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 20:04:28 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:41088: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.251
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/welding.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:05:21 dovecot_login authenticator failed for H=(pVsFC8SXRt) [2.58.56.77]:60321: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.148.116
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/3-3.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:05:15 dovecot_login authenticator failed for H=(ApK5FXKSV6) [158.94.208.175]:61963: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.125.142
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/c-68.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:05:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.1.108.169
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/Cabe website 07072021 without bg grid (PNG).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.85.27.190
country_id: 3865483
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/Cabe-Website-Photo-v1.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:05:02 dovecot_login authenticator failed for H=(FNTfhQHDC) [45.94.31.131]:56649: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:06:13 dovecot_login authenticator failed for H=(eAFTbM) [158.94.208.175]:64824: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:06:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:06:22 dovecot_login authenticator failed for H=(5P4qHG4Gr) [45.94.31.131]:63391: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2026-01-31 20:06:43 dovecot_login authenticator failed for H=wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:51567: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:06:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.164.184
country_id: 3865483
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/c-51.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:06:10 dovecot_login authenticator failed for H=(QpQyjAdv) [2.58.56.77]:60876: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.132.181.183
country_id: 1210997
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/DBA Trophy.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:07:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:07:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:07:21 dovecot_login authenticator failed for H=(3toIunZnp3) [158.94.208.175]:58802: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:07:22 dovecot_login authenticator failed for H=(JouIZs50) [45.94.31.131]:65524: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:07:17 dovecot_login authenticator failed for H=(Vt5cET) [2.58.56.77]:56631: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:07:36 dovecot_login authenticator failed for H=(6NEhkJ) [146.70.146.50]:61076: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:08:20 dovecot_login authenticator failed for H=(iRAuBh14) [45.94.31.131]:56947: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:08:18 dovecot_login authenticator failed for H=(ii32bbfZe2) [158.94.208.175]:65090: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:08:34 dovecot_login authenticator failed for H=(JEc8xzW5Yi) [158.94.208.175]:56180: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.16
country_id: 1269750
description:
2026-01-31 20:08:09 dovecot_login authenticator failed for H=(ADMIN) [103.108.174.16]:50349: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:08:17 dovecot_login authenticator failed for H=(F99oBE) [146.70.146.50]:50193: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31 20:08:42 51528 [Warning] Aborted connection 51528 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:09:04 dovecot_login authenticator failed for H=(7uD4842JwC) [158.94.208.175]:55750: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 20:09:39 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:36555: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:09:17 dovecot_login authenticator failed for H=(MdnhhKPp) [45.94.31.131]:52601: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 20:09:07 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:33868: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:09:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60488: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 20:09:43 H=([45.144.212.50]) [45.144.212.50]:57877 F=<ccmsservice@bangkokbank.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.105.22
country_id: 2363686
description:
2026-01-31 20:10:51 dovecot_plain authenticator failed for H=(738K4S3IJ) [196.171.105.22]:63412: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 20:10:17 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:38808: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 20:10:18 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:43286: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:10:18 dovecot_login authenticator failed for H=(WJOlPfM3e) [158.94.208.175]:52127: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:10:39 dovecot_login authenticator failed for H=(c90gyso) [146.70.146.50]:63345: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-31 20:10:43 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:29052: 535 Incorrect authentication data (set_id=seanlee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:10:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63597: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.46.68.9
country_id: 1643084
description:
2026-01-31 20:10:09 dovecot_plain authenticator failed for H=(ZZ7H17CIG) [202.46.68.9]:35068: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:10:14 dovecot_login authenticator failed for H=(28n21vSb) [45.94.31.131]:63111: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:11:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:11:12 dovecot_login authenticator failed for H=(N3jRBE9G) [45.94.31.131]:61979: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:11:22 dovecot_login authenticator failed for H=(c4ZFvT) [146.70.146.50]:50440: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


