# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:04:09 dovecot_login authenticator failed for H=(oWLWJEI) [178.16.52.139]:59491: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:04:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:04:13 dovecot_login authenticator failed for H=(H3bMoQ) [158.94.208.175]:63216: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:05:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39842: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:05:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64899: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:05:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:05:22 dovecot_login authenticator failed for H=(HGyUxjZbfy) [158.94.208.175]:56264: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:05:26 dovecot_login authenticator failed for H=(ov59emCm) [178.16.52.139]:63515: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.249.227
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/sponsor-cabinet.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:06:08 dovecot_login authenticator failed for H=(zoM6MuA) [158.94.208.175]:59124: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:06:25 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59153: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:06:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:06:18 dovecot_login authenticator failed for H=(ubyYO2B8) [178.16.52.139]:58683: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-02 02:06:22 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:59490: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-02 02:06:49 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:36696: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:06:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59153: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-02 02:07:09 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:43747: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:07:15 dovecot_login authenticator failed for H=(OB498xQWZ) [178.16.52.139]:61255: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 02:07:37 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:23086: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:07:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43014: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:07:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:07:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54920: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:07:17 dovecot_login authenticator failed for H=(NmDkBbFN) [158.94.208.175]:65498: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-02-02 02:08:27 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:30890: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-02 02:08:43 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:59172: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2026-02-02 02:08:48 dovecot_login authenticator failed for H=([213.234.8.114]) [213.234.8.114]:42910: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:08:04 dovecot_login authenticator failed for H=(ymLN6K42BA) [158.94.208.175]:54543: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:08:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58596: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.12.72
country_id: 6252001
description:
[2026-02-02 02:08:31 +0800] info [cpaneld] 103.60.12.72 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.250.213.157
country_id: 2017370
description:
2026-02-02 02:08:38 dovecot_login authenticator failed for H=([89.250.213.157]) [89.250.213.157]:52142: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:08:15 dovecot_login authenticator failed for H=(Wib3gXr9gR) [178.16.52.139]:56363: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:08:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-02 02:09:51 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13969: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:09:04 dovecot_login authenticator failed for H=(gRzLFnsI) [178.16.52.139]:62091: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:09:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57621: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:09:14 dovecot_login authenticator failed for H=(yC65Y5o) [158.94.208.175]:57249: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:10:01 dovecot_login authenticator failed for H=(iDkmyHzXkV) [158.94.208.175]:56479: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-02-02 02:10:21 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net [110.25.112.143]:58012: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:10:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44076: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-02 02:10:06 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:44880: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:10:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50612: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:10:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64627: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-02 02:10:05 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:55442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:10:27 dovecot_login authenticator failed for H=(CWJT9j) [178.16.52.139]:52238: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-02 02:10:51 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (unized) [68.52.119.193]:37590: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:11:10 dovecot_login authenticator failed for H=(D6bK9Svp) [158.94.208.175]:57864: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.137.161.10
country_id: 1210997
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/new-carton-box?product_id=441 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.137.161.10
country_id: 1210997
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/new-carton-box?product_id=441 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:11:03 dovecot_login authenticator failed for H=(IPYIF9gw) [178.16.52.139]:65052: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:11:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62945: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:12:10 dovecot_login authenticator failed for H=(wBE0EQZP) [178.16.52.139]:54291: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:12:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40604: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:12:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55945: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.90.234
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74861514942266 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:12:40 dovecot_login authenticator failed for H=(qxF55DvMQ) [158.94.208.175]:58870: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:13:39 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52935: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:13:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:13:03 dovecot_login authenticator failed for H=(qf8xjo) [158.94.208.175]:65361: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:13:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63869: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:13:11 dovecot_login authenticator failed for H=(kb8RDiLX) [178.16.52.139]:64203: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 02:13:36 dovecot_plain authenticator failed for H=(revult) [102.53.15.56]:34853: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 02:14:23 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (wasanes) [87.103.126.54]:27189: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:14:06 dovecot_login authenticator failed for H=(38EZETS0V) [178.16.52.139]:56754: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:14:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:14:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64501: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:14:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42336: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:14:12 dovecot_login authenticator failed for H=(X283C9O9) [158.94.208.175]:56930: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.244.10.185
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124717 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.243.24.178
country_id: 1814991
description:
2026-02-02 02:15:21 dovecot_login authenticator failed for H=([223.243.24.178]) [223.243.24.178]:45843: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:15:21 dovecot_login authenticator failed for H=(sOVzwL6) [158.94.208.175]:53061: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:15:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62851: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 02:15:51 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:41323: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:15:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 02:15:20 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:60113: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 02:15:28 dovecot_login authenticator failed for H=(LWsgfylqU) [178.16.52.139]:50058: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-02 02:15:41 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:43380: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 02:15:37 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:25168: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:16:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:16:07 dovecot_login authenticator failed for H=(IEo0Ro) [158.94.208.175]:51305: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 02:16:26 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:48414: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:16:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41636: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:16:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60904: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 02:16:48 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:33614: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-02-02 02:17:08 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:45962: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:17:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56244: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:17:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.76.137.150
country_id: 6252001
description:
2026-02-02 02:17:38 dovecot_login authenticator failed for H=149-76-137-150.fidnet.com [149.76.137.150]:50853: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-02-02 02:17:51 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:47504: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:17:16 dovecot_login authenticator failed for H=(h9tbLPsqw) [158.94.208.175]:63183: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.178.14
country_id: 1814991
description:
2026-02-02 02:17:23 dovecot_login authenticator failed for H=([58.19.210.43]) [119.36.178.14]:35282: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:17:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64113: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:18:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55642: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.21.252.217
country_id: 3469034
description:
2026-02-02 02:18:10 dovecot_login authenticator failed for H=(localhost) [185.21.252.217]:59970: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:18:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50564: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:18:02 dovecot_login authenticator failed for H=(5jWwNE) [158.94.208.175]:58699: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:19:11 dovecot_login authenticator failed for H=(jaDBB9) [158.94.208.175]:60411: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-02-02 02:19:20 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:37753: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 190.2.151.129
country_id: 2750405
domain: www.nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:sub||MV:999999.9' union all select 0x31303235343830303536,(select concat(0x7e,0x27,count(table_name),0x27,0x7e) from `information_schema`.tables where table_schema=0x6E6F626C656465635F74757070657277655F6E6F626C65646563),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536 and 'x'='x||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 190.2.151.129
country_id: 2750405
domain: www.nobledec.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:sub||MV:999999.9' union all select 0x31303235343830303536,(select concat(0x7e,0x27,count(table_name),0x27,0x7e) from `information_schema`.tables where table_schema=0x6E6F626C656465635F74757070657277655F6E6F626C65646563),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536 and 'x'='x||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.200.54.27
country_id: 1269750
description:
2026-02-02 02:20:00 dovecot_login authenticator failed for H=([127.0.0.1]) [121.200.54.27]:7033: 535 Incorrect authentication data (set_id=khairul@ajplantations.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 190.2.151.129
country_id: 2750405
domain: www.nobledec.com
description:
IM360 WAF: PHP Injection Low value||MV:999999.9' union all select 0x31303235343830303536,(select concat(0x7e,0x27,count(table_name),0x27,0x7e) from `information_schema`.tables where table_schema=0x6E6F626C656465635F74757070657277655F6E6F626C65646563),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536 and 'x'='x||MVN:ARGS:sub||RSV:7.71||T:APACHE||SC:/home2/nobledec/public_html/product.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-02-02 02:19:07 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:53323: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:19:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62393: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 02:19:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (loeges) [87.103.126.54]:26632: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:20:50 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57195: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-02-02 02:20:47 dovecot_login authenticator failed for H=(223-197-145-141.static.imsbiz.com) [223.197.145.141]:54398: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.152.139
country_id: 1814991
description:
2026-02-02 02:20:10 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.152.139]:37429: 535 Incorrect authentication data (set_id=khairul)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.122.155
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=515102 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:20:20 dovecot_login authenticator failed for H=(WDENTC3A) [158.94.208.175]:62090: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:20:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58433: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.25.45
country_id: 3175395
description:
2026-02-02 02:21:13 dovecot_plain authenticator failed for H=(sacke) [82.84.25.45]:59940: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:21:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51911: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 02:21:03 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:34494: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:21:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55012: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:21:27 dovecot_login authenticator failed for H=(vaustGrQgi) [158.94.208.175]:58425: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  2:22:51 253709 [Warning] Aborted connection 253709 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:22:13 dovecot_login authenticator failed for H=(gyv40Z) [158.94.208.175]:61216: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.71.48.66
country_id: 3277605
description:
2026-02-02 02:22:31 dovecot_login authenticator failed for H=([127.0.0.1]) [217.71.48.66]:56210: 535 Incorrect authentication data (set_id=premulutu)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:22:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:22:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61545: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.15.19.170
country_id: 1814991
description:
2026-02-02 02:22:25 dovecot_login authenticator failed for H=([127.0.0.1]) [27.15.19.170]:56799: 535 Incorrect authentication data (set_id=premulutu@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:23:22 dovecot_login authenticator failed for H=(Cv9iWDVM8t) [158.94.208.175]:56516: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.180.9
country_id: 2017370
description:
2026-02-02 02:23:30 dovecot_login authenticator failed for H=broadband-178-140-180-9.ip.moscow.rt.ru [178.140.180.9]:60938: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 02:23:15 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:57809: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:23:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-02-02 02:23:50 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com [95.210.105.202]:27899: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:23:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53983: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:23:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60928: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-02 02:23:51 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:59162: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-02-02 02:24:02 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:53370: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-02 02:24:53 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:39398: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:24:09 dovecot_login authenticator failed for H=(rWaBBGcrn) [158.94.208.175]:60745: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.177.220
country_id: 6252001
domain: www.mams1.manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:24:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:24:23 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62952: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:24:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62952: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 02:24:42 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:52932: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:25:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56704: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:25:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:25:18 dovecot_login authenticator failed for H=(GSJhXUr) [158.94.208.175]:58071: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:25:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57552: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.157.14
country_id: 1814991
description:
2026-02-02 02:26:27 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.157.14]:48706: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:26:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65224: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:26:06 dovecot_login authenticator failed for H=(mMr2SK) [158.94.208.175]:62409: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:26:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.58.128.5
country_id: 6252001
description:
2026-02-02 02:26:34 dovecot_login authenticator failed for H=([127.0.0.1]) [184.58.128.5]:46051: 535 Incorrect authentication data (set_id=jessieteoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 02:28:02 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:57938: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:27:15 dovecot_login authenticator failed for H=(YsLeEcHpMP) [158.94.208.175]:62514: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:27:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37352: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:27:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60964: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-02-02 02:29:01 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (vituffeaph) [73.0.191.33]:54940: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 02:28:11 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:51860: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 02:28:34 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:42505: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/ajresortscom/public_html/images||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:28:32 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54703: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:28:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54703: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-02 02:28:22 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:19861: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:28:24 dovecot_login authenticator failed for H=(k1EJpi) [158.94.208.175]:60418: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 02:28:32 dovecot_login authenticator failed for H=(ePOfZF5cMv) [69.5.189.21]:61729: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home2/ajresortscom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:29:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64742: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 02:29:13 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:53332: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-02-02 02:29:14 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (butic) [73.199.161.144]:42540: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 02:29:19 dovecot_login authenticator failed for H=(fonArDj) [69.5.189.21]:55206: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:29:10 dovecot_login authenticator failed for H=(FSFXhTM8f) [158.94.208.175]:51859: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:29:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49044: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 02:30:20 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:37828: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:30:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58273: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:30:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 02:30:28 dovecot_login authenticator failed for H=(Pt1iqB8) [69.5.189.21]:54441: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-02 02:30:53 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:58613: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:30:20 dovecot_login authenticator failed for H=(vMvz8rmOo) [158.94.208.175]:57568: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.15.93
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:31:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 02:31:16 dovecot_login authenticator failed for H=(Xc0Fr7) [69.5.189.21]:55406: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:31:06 dovecot_login authenticator failed for H=(tGbUj3u) [158.94.208.175]:50172: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:31:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62867: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:32:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62440: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:32:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-02 02:32:28 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:44724: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-02 02:32:21 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:46602: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:32:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40276: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:32:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59791: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 02:32:25 dovecot_login authenticator failed for H=(HEIP8H) [69.5.189.21]:50088: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 02:32:52 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:58346: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:32:15 dovecot_login authenticator failed for H=(PBlsUfA3sp) [158.94.208.175]:54345: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-02 02:32:25 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:39268: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-02 02:32:39 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:61560: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.156.50
country_id: 289688
description:
2026-02-02 02:33:38 dovecot_login authenticator failed for H=([127.0.0.1]) [37.208.156.50]:48634: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:33:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56019: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 02:33:37 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:59387: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-02 02:33:50 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:50596: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 02:33:12 dovecot_login authenticator failed for H=(ZeuOsqtTzp) [69.5.189.21]:57821: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.186.66
country_id: 1269750
description:
2026-02-02 02:33:50 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.186.66]:35346: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:33:01 dovecot_login authenticator failed for H=(DqYaXOetE) [158.94.208.175]:61802: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:33:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-02 02:33:50 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:52126: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:34:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.27.159
country_id: 1814991
description:
2026-02-02 02:34:29 dovecot_login authenticator failed for H=([124.134.27.159]) [124.134.27.159]:10240: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-02-02 02:34:04 dovecot_plain authenticator failed for H=(buthes) [207.254.29.22]:60517: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:34:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65336: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:34:10 dovecot_login authenticator failed for H=(9u9wgK9d) [158.94.208.175]:65502: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:34:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58290: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-02-02 02:34:01 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (zolaus) [67.172.54.29]:42708: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-02 02:34:35 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:49622: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 02:34:05 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:34653: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.122
country_id: 1210997
description:
2026-02-02 02:34:38 dovecot_login authenticator failed for H=([49.0.36.122]) [49.0.36.122]:34498: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-02 02:34:52 dovecot_login authenticator failed for H=([122.187.230.104]) [122.187.230.104]:41242: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 02:35:50 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:57548: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:35:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58379: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:35:20 dovecot_login authenticator failed for H=(n6QNOCXT9) [158.94.208.175]:52514: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:35:49 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61430: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-02-02 02:35:40 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:56990: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:35:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 02:36:33 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:36468: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-02-02 02:36:44 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:60559: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:36:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34274: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:36:06 dovecot_login authenticator failed for H=(CXqamgu6R0) [158.94.208.175]:62148: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:36:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50318: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:37:15 dovecot_login authenticator failed for H=(ORZoQve) [158.94.208.175]:51194: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.44.115
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=222230 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-02-02 02:37:56 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (stemas) [73.230.86.50]:58066: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:37:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60757: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.123.170.104
country_id: 6252001
domain: www.achieversvisionacademy.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/125.0.6422.60 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:38:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51476: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:38:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53764: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:38:24 dovecot_login authenticator failed for H=(ld3Qtrtb6H) [158.94.208.175]:57474: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:39:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62486: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:39:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49203: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:39:10 dovecot_login authenticator failed for H=(dYZpGh) [158.94.208.175]:50219: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:39:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-02-02 02:39:55 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (stous) [68.82.141.145]:41440: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-02-02 02:40:00 dovecot_plain authenticator failed for H=(pired) [84.238.92.245]:46708: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:40:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:40:20 dovecot_login authenticator failed for H=(uBgkTXU) [158.94.208.175]:56148: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:40:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57882: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:40:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37438: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:41:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:41:06 dovecot_login authenticator failed for H=(dNxXMP7w) [158.94.208.175]:64383: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:41:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55150: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:42:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:42:15 dovecot_login authenticator failed for H=(7DrdZt) [158.94.208.175]:51638: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:42:46 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52707: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:42:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49374: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:43:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63438: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.250.132.255
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1098 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.162
country_id: 1733045
description:
2026-02-02 02:43:11 dovecot_login authenticator failed for H=([183.171.7.162]) [183.171.7.162]:44024: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:43:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:43:24 dovecot_login authenticator failed for H=(uUKvaa) [158.94.208.175]:55653: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:44:50 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57218: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:44:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 02:44:12 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:6731: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.50.68
country_id: 1269750
domain: dps-comsec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13466.dps-comsec.com||ServerName:dps-comsec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b879a9dc04b62efa110f96736eb0734c0fb90955||Title:0x9cd29b39||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:44:10 dovecot_login authenticator failed for H=(8ajJVMEnK) [158.94.208.175]:62998: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-02 02:45:24 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:36938: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:45:17 dovecot_login authenticator failed for H=(KLhCDk) [158.94.208.175]:64581: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 02:45:19 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:48232: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-02 02:45:35 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:38730: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 02:45:09 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:40784: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:45:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57218: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 02:45:47 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:57056: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:45:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48022: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.145.187.247
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=24 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-02 02:45:18 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:44109: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 02:46:29 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:59811: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-02-02 02:46:05 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:56913: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:46:03 dovecot_login authenticator failed for H=(vFZfsBYdg) [158.94.208.175]:56160: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:46:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53026: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 02:46:18 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:51829: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/aircarbonicadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:47:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62098: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:47:13 dovecot_login authenticator failed for H=(uYiP3nYXD) [158.94.208.175]:60347: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:47:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39872: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:48:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55836: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:48:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2026-02-02 02:48:57 dovecot_login authenticator failed for H=([222.128.15.127]) [222.128.15.127]:59490: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.221.222
country_id: 2921044
description:
[2026-02-02 02:48:41 +0800] info [cpaneld] 144.31.221.222 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-02-02 02:48:18 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:35930: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:48:22 dovecot_login authenticator failed for H=(r4tD3onpK) [158.94.208.175]:50297: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:49:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-02-02 02:49:05 dovecot_plain authenticator failed for H=(sasta) [31.173.8.170]:3977: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:49:08 dovecot_login authenticator failed for H=(ckYbikh) [158.94.208.175]:61604: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-02-02 02:49:24 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (hones) [24.61.199.212]:33828: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.206.7.126
country_id: 1814991
description:
2026-02-02 02:49:12 dovecot_login authenticator failed for H=([221.206.7.126]) [221.206.7.126]:42525: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:49:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51802: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:49:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59118: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:49:54 dovecot_login authenticator failed for H=(auoC3FdJ5) [158.94.208.175]:56494: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77093094
abuser: 176.65.139.7
country_id: 2921044
domain: 42.0.28.63:443
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: 'NEXT_REDIRECT;push;/login?a=' res ';307;'});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-02-02 02:50:58 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:45145: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:50:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:50:17 dovecot_login authenticator failed for H=(Av5AZjx) [158.94.208.175]:53323: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:50:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53256: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 02:50:14 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:59465: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:51:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:51:03 dovecot_login authenticator failed for H=(viZ5WR) [158.94.208.175]:50145: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 02:51:14 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:56272: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 02:51:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (annable) [87.103.126.54]:23786: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:51:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:51:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62539: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.189.28.89
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/next/18/162/1889339 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 02:51:52 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:39017: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.181
country_id: 1668284
description:
2026-02-02 02:52:42 dovecot_login authenticator failed for H=111-70-49-181.emome-ip.hinet.net [111.70.49.181]:40740: 535 Incorrect authentication data


plugin: modsec
rule: 77316775
name: IM360 WAF: Laravel Ignition RCE via stream wrapper (CVE-2021-3129)
abuser: 138.2.67.195
country_id: 1880251
domain: achieversvisionacademy.com
description:
IM360 WAF: Laravel Ignition RCE via stream wrapper (CVE-2021-3129)||RSV:7.71||T:APACHE||MV:php://filter/read=consumed/resource=../storage/logs/laravel.log||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:52:12 dovecot_login authenticator failed for H=(tTHryrGVOL) [158.94.208.175]:50443: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-02-02 02:52:29 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:56400: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:52:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.14.101.27
country_id: 2464461
description:
2026-02-02 02:52:27 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [197.14.101.27]:58165: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-02-02 02:52:59 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:28614: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-02 02:52:18 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:55232: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:52:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56305: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2026-02-02 02:52:46 dovecot_login authenticator failed for H=([183.56.179.201]) [183.56.179.201]:58996: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:53:21 dovecot_login authenticator failed for H=(l6eDiYG5) [158.94.208.175]:51380: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:53:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41882: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 27.7.233.188
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:54156.dsc-expat.com||ServerName:dsc-expat.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9e8786b1896f155b4c7e0f9fa17e601ad8de561||Title:0x8e18ec58||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 02:53:02 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:51768: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:53:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-02  2:53:28 254817 [Warning] Aborted connection 254817 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:53:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49702: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-02-02 02:53:46 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:54602: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:54:07 dovecot_login authenticator failed for H=(75ciPoNkNw) [158.94.208.175]:52402: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:54:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60047: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.38.104.236
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/activities/un_civilsociety/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:55:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53690: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-02-02 02:55:51 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:39877: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.100.160.90
country_id: 2589581
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/activities/un_civilsociety/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.141.215
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/activities/un_civilsociety/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.84.212
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/activities/un_civilsociety/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.102.211.51
country_id: 6254930
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/activities/un_civilsociety/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:55:16 dovecot_login authenticator failed for H=(HuPNPUcjuY) [158.94.208.175]:54888: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.104.37.69
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/activities/un_civilsociety/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:55:39 dovecot_login authenticator failed for H=(yZS5or6I) [158.94.208.175]:55258: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:56:26 dovecot_login authenticator failed for H=(ACMGUoZP0) [158.94.208.175]:56408: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.187.47
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21051514942871 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-02-02 02:56:04 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:44096: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-02 02:56:21 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:50963: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:56:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54762: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 02:56:34 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:36194: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:57:12 dovecot_login authenticator failed for H=(VmQNXEeS) [158.94.208.175]:59505: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-02 02:57:34 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:15018: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:57:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64804: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:57:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-02-02 02:57:58 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:47168: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-02-02 02:57:14 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:49697: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:58:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61105: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 02:58:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42166: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-02-02 02:58:28 dovecot_plain authenticator failed for H=(spilla) [50.187.152.61]:53976: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.52
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/photos/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:58:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:58:21 dovecot_login authenticator failed for H=(RMNDcC) [158.94.208.175]:62480: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-02-02 02:58:23 dovecot_login authenticator failed for H=([14.42.47.150]) [14.42.47.150]:28827: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 02:58:31 dovecot_plain authenticator failed for H=(hetatowab) [176.113.155.132]:51810: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 02:58:41 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59111: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 02:59:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55241: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 02:59:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 02:59:07 dovecot_login authenticator failed for H=(K9bHDUDv) [158.94.208.175]:65175: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-02 02:59:22 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:36872: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:00:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39478: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:00:40 dovecot_login authenticator failed for H=(dBepZUVw) [158.94.208.175]:60801: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-02-02 03:00:04 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:37064: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:00:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 03:00:24 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:37116: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2026-02-02 03:00:24 dovecot_login authenticator failed for H=([121.128.76.110]) [211.196.31.2]:44451: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-02-02 03:00:39 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:46026: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:00:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64584: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:00:16 dovecot_login authenticator failed for H=(60PEYw) [158.94.208.175]:56348: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 03:01:58 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:55120: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:01:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58179: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.241.157
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/light/18/104/1890018 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-02-02 03:01:45 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:10462: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:01:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-02 03:01:03 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:44736: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:01:03 dovecot_login authenticator failed for H=(KAYBR9u0M) [158.94.208.175]:64688: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-02 03:01:15 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:60896: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 03:01:01 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:44612: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-02  3:01:51 255212 [Warning] Aborted connection 255212 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 03:01:14 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:60764: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 03:01:34 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:48656: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:02:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51697: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:02:13 dovecot_login authenticator failed for H=(JMQDGt853) [158.94.208.175]:54289: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 03:02:32 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:36179: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:02:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60446: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 154.54.249.193
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dovecot/dovecot.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:03:22 dovecot_login authenticator failed for H=(JQSrUt4sPG) [158.94.208.175]:63390: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2026-02-02 03:03:38 dovecot_login authenticator failed for H=([59.145.171.168]) [182.78.82.194]:57748: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:03:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55324: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-02-02 03:03:59 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:36840: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 03:03:36 +0800] info [cpaneld] 185.204.54.153 - iwakgnal "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iwakgnal (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2026-02-02 03:03:55 dovecot_login authenticator failed for H=(techday.com.ua) [46.149.83.62]:51053: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.36.138
country_id: 1814991
description:
2026-02-02 03:03:58 dovecot_login authenticator failed for H=([58.56.145.62]) [144.123.36.138]:54244: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.78.236.162
country_id: 1269750
domain: dynamic-hr.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87451.dynamic-hr.com.my||ServerName:dynamic-hr.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e7e44809e22686301506bdc15851adb1a5922888||Title:0xde567bcf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 03:04:41 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:52512: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:04:46 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50067: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 03:04:21 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (cyticy) [87.103.126.54]:31324: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 03:04:52 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:12052: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:04:07 dovecot_login authenticator failed for H=(YL00RFcVQ) [158.94.208.175]:51351: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 03:04:27 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:59948: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-02 03:04:31 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:55132: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-02-02 03:04:51 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:37248: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:04:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51764: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 03:05:34 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:51500: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:05:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50067: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:05:16 dovecot_login authenticator failed for H=(frAzZN) [158.94.208.175]:60924: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2026-02-02 03:05:57 dovecot_plain authenticator failed for H=dsl540122f2.fixip.t-online.hu (amebrateke) [84.1.34.242]:39466: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:05:47 dovecot_login authenticator failed for H=(eZVbMF) [178.16.54.138]:57313: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-02 03:05:21 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:52830: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-02 03:06:23 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:55332: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:06:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53155: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-02 03:06:47 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:38756: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:06:03 dovecot_login authenticator failed for H=(G1IwjC6j) [158.94.208.175]:49673: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 03:06:12 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52538: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:06:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/pam_env.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:06:51 dovecot_login authenticator failed for H=(w973CU8O) [178.16.54.138]:49325: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 03:07:02 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:38188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:07:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:07:13 dovecot_login authenticator failed for H=(AMFTgQ) [158.94.208.175]:59929: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-02  3:07:54 255500 [Warning] Aborted connection 255500 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:07:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64330: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:08:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57176: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-02 03:08:04 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:45988: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:08:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 03:08:21 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:39319: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:08:22 dovecot_login authenticator failed for H=(LlxfQDN) [158.94.208.175]:52915: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-02 03:09:23 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:52879: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:09:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51340: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:09:31 dovecot_login authenticator failed for H=(mQbquhUXy) [158.94.208.175]:61640: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:09:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:09:08 dovecot_login authenticator failed for H=(U1YwJZt6) [158.94.208.175]:59244: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 03:09:12 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:56167: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:09:29 dovecot_login authenticator failed for H=(c4dubLk7) [178.16.54.138]:50100: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:10:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36756: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:10:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62064: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:10:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:10:17 dovecot_login authenticator failed for H=(u7BZe2fl) [158.94.208.175]:50213: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 03:11:19 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:21756: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:11:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54630: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:11:03 dovecot_login authenticator failed for H=(ZVV7gv) [158.94.208.175]:55181: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 03:11:08 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:56456: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.134.245.11
country_id: 1227603
description:
2026-02-02 03:11:23 dovecot_plain authenticator failed for H=(Z69Q27X) [112.134.245.11]:62895: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:12:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64858: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 03:12:29 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:56504: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:12:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54658: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:12:12 dovecot_login authenticator failed for H=(6vCNjA) [158.94.208.175]:65335: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.243
country_id: 1819730
description:
2026-02-02 03:12:45 dovecot_login authenticator failed for H=243.142.48.116.static.netvigator.com [116.48.142.243]:56045: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-02-02 03:13:34 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (chusably) [67.172.54.29]:39680: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-02 03:13:56 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:42850: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:13:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57550: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:13:21 dovecot_login authenticator failed for H=(hSLOiR) [158.94.208.175]:55741: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-02 03:13:41 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:47041: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:13:09 dovecot_login authenticator failed for H=(GpavJ8xb) [178.16.54.138]:51620: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:14:07 dovecot_login authenticator failed for H=(tuccMOVL) [158.94.208.175]:62633: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:14:12 dovecot_login authenticator failed for H=(XldJXyL) [178.16.54.138]:55404: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.185.57.75
country_id: 1269750
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/tilam/fefilivin.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:14:53 dovecot_login authenticator failed for H=(8gi5NWdty) [158.94.208.175]:52556: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:14:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50714: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:14:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50800: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.142.1.173
country_id: 1814991
description:
2026-02-02 03:15:12 dovecot_login authenticator failed for H=([220.189.239.206]) [183.142.1.173]:51214: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:15:17 dovecot_login authenticator failed for H=(hQmmtOj) [158.94.208.175]:56632: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-02-02 03:15:24 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:58810: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:15:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60062: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:15:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-02-02 03:15:09 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:34048: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:15:15 dovecot_login authenticator failed for H=(ZioMl9k) [178.16.54.138]:56299: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:17:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44556: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:16:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52977: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:16:22 dovecot_login authenticator failed for H=(Q93fB13) [178.16.54.138]:62835: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:16:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:16:03 dovecot_login authenticator failed for H=(f4XNdmE) [158.94.208.175]:64961: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.189.202.227
country_id: 2017370
description:
2026-02-02 03:16:33 dovecot_login authenticator failed for H=([127.0.0.1]) [213.189.202.227]:65294: 535 Incorrect authentication data (set_id=inf@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.196
country_id: 1814991
description:
2026-02-02 03:16:41 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.196]:52353: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:17:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:17:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64501: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:17:12 dovecot_login authenticator failed for H=(faOB1Z) [158.94.208.175]:57960: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/pipewire.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:18:21 dovecot_login authenticator failed for H=(bTkn8N1f6) [158.94.208.175]:49798: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:19:02 dovecot_login authenticator failed for H=(H826Bplb6) [178.16.54.138]:60542: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-02-02 03:19:02 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:53059: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:18:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58263: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:18:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 03:19:44 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:55964: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:19:08 dovecot_login authenticator failed for H=(RlF8dFKJP0) [158.94.208.175]:56016: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-02 03:19:10 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:57540: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-02 03:19:20 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:63437: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:19:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41276: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:19:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54194: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-02 03:19:58 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:52400: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:20:05 dovecot_login authenticator failed for H=(EEaN2rh) [178.16.54.138]:58410: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:20:18 dovecot_login authenticator failed for H=(YfRYN9if) [158.94.208.175]:54770: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:20:41 dovecot_login authenticator failed for H=(8au5sW) [158.94.208.175]:57848: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 03:20:59 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:40848: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 03:20:32 +0800] info [cpaneld] 185.204.54.153 - periflnl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user periflnl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:20:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51048: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-02-02 03:20:51 dovecot_plain authenticator failed for H=(coness) [84.238.92.245]:53242: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 03:21:13 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:46387: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:22:01 dovecot_login authenticator failed for H=(CUnB4OPcro) [178.16.54.138]:50923: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:21:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63190: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:21:04 dovecot_login authenticator failed for H=(w0CcFC7) [158.94.208.175]:60460: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:21:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46480: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 131.255.21.227
country_id: 3469034
domain: egbwawasan.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15006.egbwawasan.com.my||ServerName:egbwawasan.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:20ec50795045f736f7f3b4729ae2b919a05f7835||Title:0xea0a36ba||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-02-02 03:22:42 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (oveldhely) [73.161.96.107]:38134: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 03:22:11 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:56926: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2026-02-02 03:22:24 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:60091: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2026-02-02 03:22:40 dovecot_login authenticator failed for H=([218.146.255.221]) [218.146.255.221]:54979: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:22:13 dovecot_login authenticator failed for H=(7qcePnSd) [158.94.208.175]:50483: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 03:22:54 +0800] info [cpaneld] 185.204.54.153 - krammik "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user krammik (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:22:55 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58336: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:23:03 dovecot_login authenticator failed for H=(ba6u6qQi) [178.16.54.138]:52858: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:23:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58336: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-02-02 03:23:22 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:57910: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:23:23 dovecot_login authenticator failed for H=(jSLIzhT7) [158.94.208.175]:56518: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 03:23:32 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:40604: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.248.183.23
country_id: 2542007
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/?p=826 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:23:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:23:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39144: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-02-02 03:24:07 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:38680: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:24:09 dovecot_login authenticator failed for H=(kSXzJn) [158.94.208.175]:56688: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2026-02-02 03:24:18 dovecot_login authenticator failed for H=66.68.243.35.bc.googleusercontent.com [35.243.68.66]:54720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:24:05 dovecot_login authenticator failed for H=(oHs4zc0) [178.16.54.138]:58652: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:24:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:24:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52121: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:25:04 dovecot_login authenticator failed for H=(iuzBL6) [178.16.54.138]:57371: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-02 03:25:38 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13530: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:25:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2026-02-02 03:25:16 dovecot_login authenticator failed for H=([60.166.31.198]) [60.166.31.198]:53366: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:25:18 dovecot_login authenticator failed for H=(jQsgoTDh) [158.94.208.175]:57673: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-02 03:25:07 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:58726: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:25:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63770: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:25:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 03:25:27 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:65114: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:25:41 dovecot_login authenticator failed for H=(lNKgwRi) [158.94.208.175]:58291: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:26:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57756: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:26:06 dovecot_login authenticator failed for H=(PyYET9) [178.16.54.138]:49703: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:26:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:26:04 dovecot_login authenticator failed for H=(90nO4Iy) [158.94.208.175]:59611: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-02-02 03:26:27 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:47886: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-02 03:26:41 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:42460: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.113.246
country_id: 1605651
description:
2026-02-02 03:27:01 dovecot_plain authenticator failed for H=ppp-171-97-113-246.revip8.asianet.co.th (B9MP3) [171.97.113.246]:4345: 535 Incorrect authentication data (set_id=mkchong@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-02 03:27:37 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:38580: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:27:14 dovecot_login authenticator failed for H=(6rvdiDD8) [158.94.208.175]:63700: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:27:49 dovecot_login authenticator failed for H=(vxpKVc) [178.16.54.138]:55144: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:27:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48312: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:27:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60523: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:27:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/component/tag/images/portfolio-detail.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-02 03:28:08 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:43980: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:28:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:28:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54167: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.211
country_id: 3996063
description:
[2026-02-02 03:28:29 +0800] info [whostmgrd] 85.12.5.211 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:28:23 dovecot_login authenticator failed for H=(LfN3Oa) [158.94.208.175]:49397: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.87.220.149
country_id: 6290252
description:
2026-02-02 03:28:27 dovecot_plain authenticator failed for H=93-87-220-149.dynamic.isp.telekom.rs (96H3V7R8Q2) [93.87.220.149]:8882: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 03:28:57 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:36886: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-02-02 03:29:43 dovecot_login authenticator failed for H=(nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:48600: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:29:48 dovecot_login authenticator failed for H=(nnoouz4oq) [178.16.54.138]:49953: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:29:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63996: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 03:29:10 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:39751: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 03:29:19 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:57768: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.122.98
country_id: 1269750
description:
2026-02-02 03:29:24 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.122.98]:40044: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.109.200.181
country_id: 1814991
description:
2026-02-02 03:29:08 dovecot_login authenticator failed for H=([223.109.200.181]) [223.109.200.181]:36944: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:29:09 dovecot_login authenticator failed for H=(48Kzy1UaM) [158.94.208.175]:61929: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-02-02 03:30:43 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (inglow) [24.61.199.212]:56658: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-02-02 03:30:47 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (drord) [73.68.220.15]:36690: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:30:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52164: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.107.96.196
country_id: 6252001
description:
2026-02-02 03:30:27 dovecot_plain authenticator failed for H=196.96.107.136.bc.googleusercontent.com (a.us-east4-b.c.hazel-goal-484320-i6.internal.) [136.107.96.196]:51460: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:30:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57067: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:30:19 dovecot_login authenticator failed for H=(osCVuVFZgw) [158.94.208.175]:65050: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:31:05 dovecot_login authenticator failed for H=(6NjdlM5rP) [158.94.208.175]:55334: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:31:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50723: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 03:31:19 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:55467: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-02 03:31:30 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:45502: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:31:38 dovecot_login authenticator failed for H=(9Be2NRd) [178.16.54.138]:51633: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:32:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53370: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:32:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:32:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45198: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:32:14 dovecot_login authenticator failed for H=(CYYyK9) [158.94.208.175]:49400: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:33:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-02-02 03:33:22 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:47508: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:33:46 dovecot_login authenticator failed for H=(1Vefi9L0d) [158.94.208.175]:63405: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-02 03:33:33 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:33826: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-02-02 03:33:36 dovecot_plain authenticator failed for H=(pranum) [65.20.148.165]:44768: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-02 03:33:45 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:44568: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 03:33:44 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:33820: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:33:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61985: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:33:23 dovecot_login authenticator failed for H=(tgeYoed) [158.94.208.175]:58477: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.227.125.54
country_id: 3469034
description:
2026-02-02 03:34:25 dovecot_login authenticator failed for H=([127.0.0.1]) [168.227.125.54]:33043: 535 Incorrect authentication data (set_id=business)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 03:34:26 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:58746: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-02-02 03:34:56 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:38160: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.70.150
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21971515379609 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 03:34:05 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:52732: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.183.238.159
country_id: 6252001
description:
2026-02-02 03:34:14 dovecot_login authenticator failed for H=([127.0.0.1]) [184.183.238.159]:36370: 535 Incorrect authentication data (set_id=business@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:34:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54611: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.101.189.149
country_id: 3579143
description:
2026-02-02 03:34:36 dovecot_plain authenticator failed for H=149.189.101.199.dyn-ip.dtfibre.fr (5HJ30XO6291) [199.101.189.149]:22863: 535 Incorrect authentication data (set_id=rahimah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-02 03:35:01 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:59527: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:34:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53406: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:34:09 dovecot_login authenticator failed for H=(CpfHAVr) [158.94.208.175]:62494: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:34:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-02 03:34:43 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:55350: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-02-02 03:35:52 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:41723: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:36:00 dovecot_login authenticator failed for H=(c8EWYbI9W) [178.16.54.138]:59085: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:35:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62677: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2026-02-02 03:35:15 dovecot_login authenticator failed for H=([60.166.31.198]) [60.166.31.198]:58199: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:35:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:35:18 dovecot_login authenticator failed for H=(BqyE0XXV) [158.94.208.175]:63546: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:36:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49205: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:36:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40412: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:36:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:36:04 dovecot_login authenticator failed for H=(MaExtQDe) [158.94.208.175]:62099: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 03:36:36 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:45228: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.29.68
country_id: 1814991
description:
2026-02-02 03:36:46 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.29.68]:39238: 535 Incorrect authentication data (set_id=sweemeng@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.153.141
country_id: 1814991
description:
2026-02-02 03:36:54 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.153.141]:45321: 535 Incorrect authentication data (set_id=sweemeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.134
country_id: 1269750
description:
2026-02-02 03:36:06 dovecot_login authenticator failed for H=([182.95.26.150]) [125.23.237.134]:36936: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:37:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59902: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-02 03:37:17 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:45274: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.96.2
country_id: 1814991
description:
2026-02-02 03:37:30 dovecot_login authenticator failed for H=([219.129.96.2]) [219.129.96.2]:46782: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:37:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:37:13 dovecot_login authenticator failed for H=(Fj8QrK5oy) [158.94.208.175]:61904: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2026-02-02 03:37:15 dovecot_login authenticator failed for H=([182.156.80.11]) [182.156.80.11]:34572: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.21
country_id: 6252001
description:
[2026-02-02 03:38:07 +0800] info [cpaneld] 144.31.238.21 - customerservice@medigo.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:38:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39494: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.46
country_id: 6252001
description:
2026-02-02 03:38:53 dovecot_plain authenticator failed for H=(voust) [216.132.40.46]:50324: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:38:26 dovecot_login authenticator failed for H=(qqUyTlX9) [178.16.54.138]:53720: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-02-02 03:38:36 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (sesprect) [98.193.112.85]:50714: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:38:22 dovecot_login authenticator failed for H=(UgpsPujss) [158.94.208.175]:64140: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:38:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62036: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.90
country_id: 1605651
description:
[2026-02-02 03:38:11 +0800] info [whostmgrd] 85.12.5.90 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:38:45 dovecot_login authenticator failed for H=(pU0zbR1w5) [158.94.208.175]:65523: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:39:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55266: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:39:28 dovecot_login authenticator failed for H=(YQhbqx) [178.16.54.138]:59307: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:39:08 dovecot_login authenticator failed for H=(2UlL47hDA) [158.94.208.175]:51042: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.83
country_id: 3625428
description:
2026-02-02 03:40:19 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.83]:42765: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:40:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45138: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:40:17 dovecot_login authenticator failed for H=(at5gVr) [158.94.208.175]:56734: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:40:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65488: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-02-02 03:40:35 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:48896: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-02-02 03:40:08 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:51374: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.90
country_id: 1605651
description:
[2026-02-02 03:40:53 +0800] info [whostmgrd] 85.12.5.90 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.103.29.13
country_id: 3057568
description:
2026-02-02 03:40:36 dovecot_login authenticator failed for H=bband-dyn13.95-103-29.t-com.sk ([127.0.0.1]) [95.103.29.13]:40737: 535 Incorrect authentication data (set_id=julie@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.57.116.192
country_id: 2921044
description:
2026-02-02 03:40:43 dovecot_login authenticator failed for H=([127.0.0.1]) [89.57.116.192]:58910: 535 Incorrect authentication data (set_id=julie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2026-02-02 03:40:07 dovecot_login authenticator failed for H=([121.189.198.60]) [121.189.198.60]:54494: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:41:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63807: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.164.135.24
country_id: 357994
description:
2026-02-02 03:41:53 dovecot_login authenticator failed for H=([127.0.0.1]) [197.164.135.24]:34469: 535 Incorrect authentication data (set_id=inf@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.135.76.38
country_id: 2635167
description:
2026-02-02 03:42:00 dovecot_login authenticator failed for H=([127.0.0.1]) [63.135.76.38]:35718: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:41:03 dovecot_login authenticator failed for H=(Wj9FaOq) [158.94.208.175]:51495: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.108.1.26
country_id: 3469034
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:66236.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69fec34dfc13bdc4899738227e83fb804dcdfd86||Title:0x7d5d8f7d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:41:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:41:30 dovecot_login authenticator failed for H=(IpTKE507vo) [178.16.54.138]:62188: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-02-02 03:42:51 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (fliciatic) [73.183.74.177]:56602: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:42:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.188.115.2
country_id: 2542007
description:
2026-02-02 03:42:07 dovecot_plain authenticator failed for H=(PBYTE98B5.localdomain) [105.188.115.2]:59792: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:42:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55785: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-02-02 03:42:47 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (cosum) [67.173.58.47]:52682: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:42:12 dovecot_login authenticator failed for H=(7zgvKCZ) [158.94.208.175]:57754: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:42:29 dovecot_login authenticator failed for H=(US2fg7g6) [178.16.54.138]:56031: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:43:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43036: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-02-02 03:43:12 dovecot_plain authenticator failed for H=(miang) [192.159.99.193]:40506: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:43:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2026-02-02 03:43:51 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:59434: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-02-02 03:44:00 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:2253: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-02-02 03:43:16 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (mamoid) [73.137.7.97]:37924: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:43:21 dovecot_login authenticator failed for H=(qXVY4EEmb) [158.94.208.175]:63993: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:43:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63482: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.92
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/what/201/128944 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:44:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:44:07 dovecot_login authenticator failed for H=(aB16x9afd) [158.94.208.175]:63529: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:44:30 dovecot_login authenticator failed for H=(33DsZZO) [158.94.208.175]:54695: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.134.231
country_id: 6252001
description:
2026-02-02  3:44:41 256847 [Warning] Aborted connection 256847 to db: 'unconnected' user: 'unauthenticated' host: '71.6.134.231' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:44:08 dovecot_login authenticator failed for H=(3ZKy2YeBJ) [178.16.54.138]:56830: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:44:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57261: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-02-02 03:44:41 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:47895: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.200.18
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30711516586311 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-02-02 03:44:52 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:60072: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:45:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-02-02 03:45:14 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:50957: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:45:16 dovecot_login authenticator failed for H=(tsViDR33E0) [158.94.208.175]:53176: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-02 03:45:24 dovecot_login authenticator failed for H=(mail.ms-chemicals.net) [61.50.119.110]:45340: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 03:45:29 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:58384: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-02-02 03:45:29 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:52812: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:45:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38932: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:45:10 dovecot_login authenticator failed for H=(UrXqju) [178.16.54.138]:59679: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:45:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51164: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-02-02 03:45:06 dovecot_plain authenticator failed for H=(golum) [37.208.46.130]:44875: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:46:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52388: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 03:46:22 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:44438: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:46:25 dovecot_login authenticator failed for H=(xXongx0nk) [158.94.208.175]:59295: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-02-02 03:46:37 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:48990: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 03:46:47 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:16896: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:46:10 dovecot_login authenticator failed for H=(Y9HC8Gi) [178.16.54.138]:54272: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:47:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62326: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 03:47:09 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:47:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38334: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:47:09 dovecot_login authenticator failed for H=(2AkcBZrnSf) [178.16.54.138]:60057: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:47:11 dovecot_login authenticator failed for H=(74wEx4GDS7) [158.94.208.175]:60286: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:48:29 dovecot_login authenticator failed for H=(8Wuv67hK) [178.16.54.138]:59737: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 03:48:03 H=(localhost.localdomain) [78.153.140.207]:46826 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:48:20 dovecot_login authenticator failed for H=(tViuwVpZU) [158.94.208.175]:55740: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:48:24 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55633: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-02 03:49:48 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:49722: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:49:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52476: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-02-02 03:49:28 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:38004: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:49:29 dovecot_login authenticator failed for H=(cGRSRvxZ) [158.94.208.175]:50072: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:49:36 dovecot_login authenticator failed for H=(yWf4OXo7R) [178.16.54.138]:58025: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:49:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49289: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:49:06 dovecot_login authenticator failed for H=(wT6KmOX26T) [158.94.208.175]:56726: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:50:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:50:16 dovecot_login authenticator failed for H=(6SikgJOGlw) [158.94.208.175]:55342: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:50:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59400: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:50:34 dovecot_login authenticator failed for H=(fQpcPN0XII) [178.16.54.138]:63196: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.9.84
country_id: 6252001
description:
[2026-02-02 03:51:16 +0800] info [webmaild] 65.111.9.84 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:51:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:51:35 dovecot_login authenticator failed for H=(2bJNUfV4O) [178.16.54.138]:53406: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:51:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52077: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 03:51:58 dovecot_plain authenticator failed for H=(racetryer) [176.113.155.132]:34136: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:51:25 dovecot_login authenticator failed for H=(ollZOk5rYP) [158.94.208.175]:62913: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:51:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36016: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:52:11 dovecot_login authenticator failed for H=(EJuMHW) [158.94.208.175]:62665: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:52:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59803: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:52:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:53:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.34.252.35
country_id: 2921044
description:
[2026-02-02 03:53:18 +0800] info [webmaild] 149.34.252.35 - eeyh@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:53:18 dovecot_login authenticator failed for H=(sbMeTK2h) [178.16.54.138]:60851: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:53:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44514: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:53:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52090: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:53:21 dovecot_login authenticator failed for H=(7NleyFTcw) [158.94.208.175]:53817: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:54:19 dovecot_login authenticator failed for H=(AWs8m5grE) [178.16.54.138]:54493: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:54:53 dovecot_login authenticator failed for H=(iAS59yqCCQ) [158.94.208.175]:61684: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:54:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61299: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:54:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:54:07 dovecot_login authenticator failed for H=(ccJCmAv1) [158.94.208.175]:50238: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:55:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64250: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 03:55:44 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:58498: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:56:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:55:16 dovecot_login authenticator failed for H=(jrOP0i) [158.94.208.175]:53190: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:55:20 dovecot_login authenticator failed for H=(pN9DxA1rD) [178.16.54.138]:53795: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-02 03:55:30 dovecot_login authenticator failed for H=(box.com.my) [61.50.119.110]:31296: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 03:55:58 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:42080: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:56:02 dovecot_login authenticator failed for H=(zitPUkt) [158.94.208.175]:51265: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 03:56:11 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:40035: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.188.18
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/011-1273_1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:56:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56674: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 03:56:04 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:59632: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-02 03:57:04 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:39904: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:57:11 dovecot_login authenticator failed for H=(5Vw7sy) [158.94.208.175]:59310: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 03:57:22 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:44510: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:57:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50064: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 03:59:00 dovecot_login authenticator failed for H=(upYdBu2S) [178.16.54.138]:62306: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:58:20 dovecot_login authenticator failed for H=(CPCoUR) [158.94.208.175]:54031: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:58:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59034: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.180
country_id: 2960313
description:
2026-02-02 03:58:51 dovecot_login authenticator failed for H=(1MYfKNUge) [37.46.113.180]:5240: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-02-02 03:58:05 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (hobstandes) [68.83.181.181]:60920: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-02-02 03:58:12 dovecot_plain authenticator failed for H=(decoury) [213.5.109.4]:60056: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.36.219.91
country_id: 3175395
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sure/18/367/1893966 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-02-02 03:58:01 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (comendius) [73.176.157.57]:38646: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-02-02 03:58:05 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (clatrecid) [76.97.155.25]:46170: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2026-02-02 03:58:39 dovecot_login authenticator failed for H=([111.26.67.36]) [111.26.67.36]:53548: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-02-02 03:58:50 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:57690: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 03:58:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55808: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2026-02-02 03:58:29 dovecot_login authenticator failed for H=([125.19.175.13]) [125.19.194.166]:42802: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 03:59:15 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:53762: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-02 03:59:56 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:52850: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 03:59:07 dovecot_login authenticator failed for H=(cH3y06f) [158.94.208.175]:56473: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.180
country_id: 2960313
description:
2026-02-02 03:59:11 dovecot_login authenticator failed for H=(JStioX5tCn) [37.46.113.180]:59244: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 03:59:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51573: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 03:59:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-02 03:59:25 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:40804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:00:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60384: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:00:16 dovecot_login authenticator failed for H=(QF0aq5) [158.94.208.175]:64426: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:00:02 dovecot_login authenticator failed for H=(x7v4efs) [178.16.54.138]:60766: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:00:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:00:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56892: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.146.174.164
country_id: 272103
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/mgmtsolutionspage HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.100.146
country_id: 1562822
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/mgmtsolutionspage/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:01:02 dovecot_login authenticator failed for H=(aUpGfH) [158.94.208.175]:50086: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:01:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52615: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:01:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:01:25 dovecot_login authenticator failed for H=(YYedYlu) [158.94.208.175]:59536: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:02:11 dovecot_login authenticator failed for H=(KMxow8MH0) [158.94.208.175]:58554: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-02 04:02:26 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:38490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-02-02 04:02:39 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:60051: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:02:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63111: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2026-02-02 04:02:14 dovecot_login authenticator failed for H=([60.166.31.198]) [60.166.31.198]:44529: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:02:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:02:57 dovecot_login authenticator failed for H=(Omm5vg) [178.16.54.138]:57722: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:02:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:03:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50896: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:03:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:03:20 dovecot_login authenticator failed for H=(ZjOzibV) [158.94.208.175]:53889: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:03:22 dovecot_login authenticator failed for H=(4JEaVwq) [178.16.54.138]:63668: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:04:06 dovecot_login authenticator failed for H=(YZuRlLLdz) [158.94.208.175]:55114: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:04:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60299: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:04:23 dovecot_login authenticator failed for H=(JsHErT) [178.16.54.138]:56656: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:04:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:05:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52891: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:05:16 dovecot_login authenticator failed for H=(Rt6NWLcxB) [158.94.208.175]:52986: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:05:20 dovecot_login authenticator failed for H=(b5uA4F) [178.16.54.138]:49661: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:06:22 dovecot_login authenticator failed for H=(10jmGzNk) [178.16.54.138]:50442: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:06:25 dovecot_login authenticator failed for H=(c4ntz9ujaY) [158.94.208.175]:61711: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:06:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58708: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:06:02 dovecot_login authenticator failed for H=(6Uokdm) [158.94.208.175]:52378: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:06:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61879: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:07:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.107.96.196
country_id: 6252001
description:
2026-02-02 04:07:02 dovecot_plain authenticator failed for H=196.96.107.136.bc.googleusercontent.com (a.us-east4-b.c.hazel-goal-484320-i6.internal.) [136.107.96.196]:59419: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:07:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55455: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:07:11 dovecot_login authenticator failed for H=(MDN0lB) [158.94.208.175]:62259: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:07:26 dovecot_login authenticator failed for H=(PB5xvYj5Jl) [178.16.54.138]:60381: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:09:00 dovecot_login authenticator failed for H=(0DKn9j7a) [178.16.54.138]:57476: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:08:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-02-02 04:08:19 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:53298: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-02-02 04:08:41 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:46100: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-02-02 04:08:14 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:3473: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:08:21 dovecot_login authenticator failed for H=(Y7WB0nOn2L) [158.94.208.175]:59077: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:08:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53301: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:09:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51126: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:09:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62603: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-02 04:09:04 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:38802: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:09:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:09:07 dovecot_login authenticator failed for H=(ACOyXY) [158.94.208.175]:58055: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:10:02 dovecot_login authenticator failed for H=(899aie) [178.16.54.138]:62353: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2026-02-02 04:10:51 dovecot_login authenticator failed for H=([49.124.153.40]) [49.124.153.40]:55954: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:10:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63139: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:10:21 dovecot_login authenticator failed for H=(Y4k9SYiYF) [158.94.208.175]:59106: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-02-02 04:11:19 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:40608: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:11:13 dovecot_login authenticator failed for H=(t21HNw36M7) [158.94.208.175]:52467: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:11:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50520: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:11:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56205: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:11:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:12:03 dovecot_login authenticator failed for H=(kNcjl51T) [178.16.54.138]:56823: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:12:12 dovecot_login authenticator failed for H=(pLxRRV6K) [158.94.208.175]:65281: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2026-02-02 04:13:00 dovecot_login authenticator failed for H=([74.196.184.78]) [74.196.184.78]:40586: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:12:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:12:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50840: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:13:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64675: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 04:13:52 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:19802: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:13:08 dovecot_login authenticator failed for H=(88D9Z4eWF8) [141.98.11.11]:52047: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:13:12 dovecot_login authenticator failed for H=(xrszrR) [158.94.208.175]:52460: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:13:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44662: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 04:13:57 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:54110: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-02-02 04:13:09 dovecot_login authenticator failed for H=([65.20.174.63]) [65.20.174.63]:36480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:13:10 dovecot_login authenticator failed for H=(GfFQkC1Mm) [178.16.54.138]:59130: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.40.106
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=23811514527372 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-02 04:14:53 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:51120: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:14:53 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58519: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:14:20 dovecot_login authenticator failed for H=(RKZm2j7nj) [141.98.11.11]:58943: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 04:14:30 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:53731: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:14:41 dovecot_login authenticator failed for H=(YHLAI0elO) [178.16.54.138]:54445: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-02 04:14:09 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:33400: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:14:11 dovecot_login authenticator failed for H=(WnLjUUb) [158.94.208.175]:55360: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.220.198
country_id: 1269750
domain: evergrown.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38343.evergrown.com.my||ServerName:evergrown.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:47c10f69fcb2fc175a877ffde672532d430c88f2||Title:0x374f72fc||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:15:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49942: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.231.80
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=135803 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:15:44 dovecot_login authenticator failed for H=(YEXyCbz7yf) [178.16.54.138]:61832: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:15:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58519: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:15:12 dovecot_login authenticator failed for H=(S2APixwm) [158.94.208.175]:65288: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:15:16 dovecot_login authenticator failed for H=(DNb3Oqkur) [141.98.11.11]:61880: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:16:13 dovecot_login authenticator failed for H=(AqS0I7) [158.94.208.175]:64693: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:16:21 dovecot_login authenticator failed for H=(rJ8u6Eq) [141.98.11.11]:49187: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:16:46 dovecot_login authenticator failed for H=(7PpEmLY) [178.16.54.138]:64935: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:16:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62808: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:17:46 dovecot_login authenticator failed for H=(IDFDFjVZlu) [178.16.54.138]:61081: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:17:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59627: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-02-02 04:17:23 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:59701: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2026-02-02 04:17:14 dovecot_login authenticator failed for H=([113.219.177.95]) [113.219.177.95]:47602: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:17:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39522: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:17:03 dovecot_login authenticator failed for H=(wkF64k) [141.98.11.11]:57596: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:17:14 dovecot_login authenticator failed for H=(nXNoiT) [158.94.208.175]:49426: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:18:20 dovecot_login authenticator failed for H=(DXKLYxeLW) [141.98.11.11]:49608: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-02-02 04:18:07 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (throver) [73.161.96.107]:56094: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:18:19 dovecot_login authenticator failed for H=(uwrnthOE) [158.94.208.175]:52431: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:18:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54308: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:19:41 dovecot_login authenticator failed for H=(XUhK8ai) [141.98.11.11]:54244: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.3.224.203
country_id: 6252001
description:
[2026-02-02 04:19:48 +0800] info [cpaneld] 173.3.224.203 - dscex "GET /login/?login_only=1&user=dscex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscex (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.23.232
country_id: 6252001
description:
[2026-02-02 04:19:51 +0800] info [cpaneld] 172.56.23.232 - dsce "GET /login/?login_only=1&user=dsce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.220.176.124
country_id: 6252001
description:
[2026-02-02 04:19:31 +0800] info [cpaneld] 72.220.176.124 - dscexpat "GET /login/?login_only=1&user=dscexpat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.137.22
country_id: 6252001
description:
[2026-02-02 04:19:41 +0800] info [cpaneld] 76.36.137.22 - dscexpa "GET /login/?login_only=1&user=dscexpa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexpa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:19:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50918: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:19:24 dovecot_login authenticator failed for H=(yiNjBeB) [158.94.208.175]:65470: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.252.178
country_id: 6252001
description:
[2026-02-02 04:19:33 +0800] info [cpaneld] 76.34.252.178 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.114.130.80
country_id: 6252001
description:
[2026-02-02 04:19:53 +0800] info [cpaneld] 73.114.130.80 - dsc "GET /login/?login_only=1&user=dsc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:19:33 dovecot_login authenticator failed for H=(aGWhIbUGQj) [178.16.52.139]:64756: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.167.12.45
country_id: 6252001
description:
[2026-02-02 04:19:44 +0800] info [cpaneld] 69.167.12.45 - dscexp "GET /login/?login_only=1&user=dscexp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexp (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:19:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49808: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.177.100.234
country_id: 6252001
description:
[2026-02-02 04:19:56 +0800] info [cpaneld] 66.177.100.234 - ds "GET /login/?login_only=1&user=ds&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ds (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.195.26
country_id: 1814991
description:
2026-02-02 04:21:00 dovecot_login authenticator failed for H=([58.218.195.26]) [58.218.195.26]:50589: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-02 04:21:01 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:54724: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:20:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60683: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.98.220.228
country_id: 2589581
description:
2026-02-02 04:20:26 dovecot_plain authenticator failed for H=(738K4S3IJ) [41.98.220.228]:57153: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:20:19 dovecot_login authenticator failed for H=(gqZK2Sn6pD) [141.98.11.11]:60530: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:20:26 dovecot_login authenticator failed for H=(tFCp2KR3) [158.94.208.175]:65016: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:20:41 dovecot_login authenticator failed for H=(xsbP4s) [178.16.54.138]:51242: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:20:48 dovecot_login authenticator failed for H=(G5qYoiBTh6) [178.16.52.139]:58558: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-02-02 04:20:49 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:41361: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:21:08 dovecot_login authenticator failed for H=(kGmv8EbOZD) [141.98.11.11]:57555: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-02-02 04:21:11 dovecot_login authenticator failed for H=([211.53.58.10]) [211.53.58.10]:54449: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:21:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51716: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:21:42 dovecot_login authenticator failed for H=(FrfyLg) [178.16.52.139]:56319: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:21:43 dovecot_login authenticator failed for H=(pG52ydzM) [178.16.54.138]:61619: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/druma_photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:22:08 dovecot_login authenticator failed for H=(kYB3OZW) [178.16.52.139]:65311: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-02-02 04:22:29 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:47603: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:22:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:22:59 dovecot_login authenticator failed for H=(9sl7qYskJ) [158.94.208.175]:56230: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:22:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36848: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:22:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60733: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:22:28 dovecot_login authenticator failed for H=(0Wm6ih) [141.98.11.11]:61949: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:22:46 dovecot_login authenticator failed for H=(gUN68IOWlm) [178.16.54.138]:51778: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 04:22:53 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48192: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:23:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55551: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:23:31 dovecot_login authenticator failed for H=(kWmejdYDg) [158.94.208.175]:62203: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:23:08 dovecot_login authenticator failed for H=(r99bHD) [141.98.11.11]:52958: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:23:28 dovecot_login authenticator failed for H=(sMiNPIAI) [178.16.52.139]:56541: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:23:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:24:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:24:52 dovecot_login authenticator failed for H=(ERcaw7my) [141.98.11.11]:57839: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.217.180.34
country_id: 1835841
domain: box.wohcheong.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:24:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64360: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:24:04 dovecot_login authenticator failed for H=(suARqK) [158.94.208.175]:55908: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-02-02 04:24:56 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:51342: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:24:21 dovecot_login authenticator failed for H=(KcZQrE2Wt) [178.16.52.139]:59206: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:24:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: box.wohcheong.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/woh/box.com.my/wp-admin/images/admin.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:25:09 dovecot_login authenticator failed for H=(ZmOy9MjTSi) [158.94.208.175]:58725: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:25:30 dovecot_login authenticator failed for H=(bz8xLJuCDO) [178.16.52.139]:54539: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.45.232
country_id: 294640
description:
2026-02-02 04:25:28 dovecot_plain authenticator failed for H=(bittion) [109.226.45.232]:53934: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 04:25:31 +0800] info [cpaneld] 185.204.54.153 - ollabidk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ollabidk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:25:36 dovecot_login authenticator failed for H=(UNYlthB) [141.98.11.11]:62245: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:25:40 dovecot_login authenticator failed for H=(1hksFIwT) [178.16.54.138]:57661: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 04:25:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-02 04:25:09 dovecot_login authenticator failed for H=([125.61.36.26]) [125.61.36.22]:58798: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:25:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63030: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:26:14 dovecot_login authenticator failed for H=(XVPeqlGQ) [158.94.208.175]:61835: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:26:18 dovecot_login authenticator failed for H=(GP9RRB) [141.98.11.11]:56235: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:26:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54620: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:26:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50170: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-02-02 04:26:24 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:56476: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-02-02 04:26:36 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:44418: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:26:49 dovecot_login authenticator failed for H=(G4iWGa) [178.16.52.139]:53797: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:27:15 dovecot_login authenticator failed for H=(znbJooVc) [178.16.52.139]:57782: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:27:21 dovecot_login authenticator failed for H=(kxIlpr) [141.98.11.11]:49336: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:27:33 dovecot_login authenticator failed for H=(emrJmx4u) [158.94.208.175]:53565: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.128.190
country_id: 1814991
description:
2026-02-02 04:27:33 dovecot_login authenticator failed for H=([58.56.128.190]) [58.56.128.190]:56790: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:27:39 dovecot_login authenticator failed for H=(Fav7gGh) [178.16.54.138]:60850: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.210.225
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/corporate.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:27:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64434: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-02-02 04:27:04 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:34547: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2026-02-02 04:28:52 dovecot_plain authenticator failed for H=(farcul) [94.254.244.211]:39998: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:28:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44730: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:28:22 dovecot_login authenticator failed for H=(FA2hJ2qDkM) [178.16.52.139]:61225: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:28:06 dovecot_login authenticator failed for H=(L86gsZXi) [158.94.208.175]:64655: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:28:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57511: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-02 04:28:43 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (epatulenes) [73.196.144.25]:43768: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:28:35 dovecot_login authenticator failed for H=(tdzhJlU) [141.98.11.11]:52325: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:29:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51100: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:29:14 dovecot_login authenticator failed for H=(WmfnTd) [141.98.11.11]:51223: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:29:36 dovecot_login authenticator failed for H=(Adpqc4d) [158.94.208.175]:65531: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.180.124
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/contect.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:29:13 dovecot_login authenticator failed for H=(CjVjsUJQ) [178.16.52.139]:60661: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/contact.php||SC:/home/indfinitydesign/public_html/images/contact.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:30:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57070: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:30:11 dovecot_login authenticator failed for H=(WFKSqlZ) [158.94.208.175]:57260: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.184
country_id: 2750405
description:
2026-02-02  4:30:15 259025 [Warning] Aborted connection 259025 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.184' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.180.52
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:30:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56940: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:30:37 dovecot_login authenticator failed for H=(YPCXGH) [178.16.54.138]:57413: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:30:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:30:18 dovecot_login authenticator failed for H=(DUf7S3zxyW) [141.98.11.11]:57445: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:30:20 dovecot_login authenticator failed for H=(779BGxqif) [178.16.52.139]:51072: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:31:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50110: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/keyword/img/index.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 04:31:51 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:44102: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:31:22 dovecot_login authenticator failed for H=(dANHqpTMb) [158.94.208.175]:57698: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:31:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:31:18 dovecot_login authenticator failed for H=(AxmJ40j0IM) [141.98.11.11]:61097: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:31:36 dovecot_login authenticator failed for H=(SrDytmSZLF) [178.16.52.139]:57805: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:32:09 dovecot_login authenticator failed for H=(1yxVOg) [178.16.52.139]:64647: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:32:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43364: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 04:32:55 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:43808: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.61.242.47
country_id: 953987
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/swepusa.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:32:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:32:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59553: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:32:27 dovecot_login authenticator failed for H=(tzkTlm) [178.16.54.138]:56857: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 04:32:36 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:44802: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/keyword/img/contact.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-02 04:32:13 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:41060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:32:23 dovecot_login authenticator failed for H=(CdIycGdC) [158.94.208.175]:62607: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:32:21 dovecot_login authenticator failed for H=(1St41V2) [141.98.11.11]:63257: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.26.68.44
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/cart.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-02 04:32:55 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:37396: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:33:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60482: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.167.93.33
country_id: 3996063
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/about_us.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:33:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:33:10 dovecot_login authenticator failed for H=(fHeto3) [178.16.52.139]:53853: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:33:31 dovecot_login authenticator failed for H=(BKHisJO5CG) [158.94.208.175]:55661: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-02-02 04:33:02 dovecot_login authenticator failed for H=([218.156.2.230]) [218.156.2.229]:33545: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-02-02 04:33:30 +0800] info [cpaneld] 34.27.42.6 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.59.2
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/single-service.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.152.147
country_id: 1814991
description:
2026-02-02 04:34:16 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.152.147]:53365: 535 Incorrect authentication data (set_id=biogrease199@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:34:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53170: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.220.43
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:35:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54146: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.15.32
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/commoditypictures.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.45.67.76
country_id: 2921044
description:
2026-02-02 04:34:22 dovecot_login authenticator failed for H=p5b2d434c.dip0.t-ipconnect.de ([127.0.0.1]) [91.45.67.76]:34784: 535 Incorrect authentication data (set_id=biogrease199)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:34:04 dovecot_login authenticator failed for H=(lAyjSavzt) [158.94.208.175]:58757: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:34:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:34:28 dovecot_login authenticator failed for H=(sUWLCI10) [178.16.52.139]:64742: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:34:03 dovecot_login authenticator failed for H=(ZG8Kb9s6) [178.16.54.138]:59613: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:35:05 dovecot_login authenticator failed for H=(0t7CoY4) [158.94.208.175]:60276: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:35:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53095: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:35:28 dovecot_login authenticator failed for H=(FRmwUBk) [178.16.52.139]:61742: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.184
country_id: 2750405
description:
2026-02-02  4:36:01 259519 [Warning] Aborted connection 259519 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.184' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.247.153
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/checkout.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-02-02 04:36:35 dovecot_plain authenticator failed for H=(rollebus) [91.72.153.110]:53115: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:36:17 dovecot_login authenticator failed for H=(bIjRreIy) [178.16.52.139]:53398: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:36:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62513: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:36:17 dovecot_login authenticator failed for H=(QraCY3p2q) [158.94.208.175]:62274: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-02-02 04:36:10 +0800] info [cpaneld] 51.75.254.157 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:37:20 dovecot_login authenticator failed for H=(mwGSUsB) [158.94.208.175]:57547: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:37:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55435: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:37:08 dovecot_login authenticator failed for H=(1EHIMkm9CM) [178.16.54.138]:55772: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.234.211
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/firstswizerland.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:37:18 dovecot_login authenticator failed for H=(hiB3A0) [178.16.52.139]:51720: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.139.32
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:37:37 dovecot_login authenticator failed for H=(oFVKtwq) [141.98.11.11]:60984: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:37:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35300: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.229
country_id: 1643084
description:
[2026-02-02 04:37:17 +0800] info [cpaneld] 95.135.92.229 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:38:14 dovecot_login authenticator failed for H=(cZL5c7We) [178.16.52.139]:64253: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:38:23 dovecot_login authenticator failed for H=(0MJLygJi) [141.98.11.11]:51363: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-02-02 04:38:29 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:36046: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:38:10 dovecot_login authenticator failed for H=(8Fepp9WLQ) [178.16.54.138]:63219: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:38:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63777: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:38:29 dovecot_login authenticator failed for H=(hR6JE9N) [158.94.208.175]:56606: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-02-02 04:38:41 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:58450: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-02-02 04:39:01 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:50432: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:39:08 dovecot_login authenticator failed for H=(gmPHRRxB1) [178.16.54.138]:56722: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:39:31 dovecot_login authenticator failed for H=(l5eYj3) [158.94.208.175]:60936: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:39:31 dovecot_login authenticator failed for H=(uybBWW) [141.98.11.11]:61147: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 04:39:25 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:52428: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:39:07 dovecot_login authenticator failed for H=(MkqPL7) [178.16.52.139]:49529: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:39:27 dovecot_login authenticator failed for H=(UiRbVMK) [165.154.217.204]:65385: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:39:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36180: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:39:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57544: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:40:06 dovecot_login authenticator failed for H=(Fbcbqh) [165.154.217.204]:53271: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:40:13 dovecot_login authenticator failed for H=(uTGCJcqkh) [141.98.11.11]:62182: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:40:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50722: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:40:25 dovecot_login authenticator failed for H=(iefGL8MMFW) [178.16.52.139]:63496: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:40:06 dovecot_login authenticator failed for H=(tVNxFNYcw) [158.94.208.175]:63577: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:41:08 dovecot_login authenticator failed for H=(gOnjsa) [178.16.54.138]:56484: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:41:08 dovecot_login authenticator failed for H=(4wvnQUSUi) [158.94.208.175]:53909: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 04:41:32 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:58687: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 04:41:54 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:40829: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:41:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52906: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:41:06 dovecot_login authenticator failed for H=(wR1liz3XLZ) [165.154.217.204]:60151: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:41:21 dovecot_login authenticator failed for H=(I04ojUNKH) [141.98.11.11]:59992: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:41:22 dovecot_login authenticator failed for H=(MctsJzGRK) [178.16.52.139]:53656: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:41:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58673: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-02-02 04:41:38 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:41492: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.122.255.9
country_id: 1210997
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:42:16 dovecot_login authenticator failed for H=(N9Jx8xv180) [158.94.208.175]:64310: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-02-02 04:42:35 dovecot_plain authenticator failed for H=(leoxist) [149.62.239.4]:50896: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:42:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51411: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:42:08 dovecot_login authenticator failed for H=(qwHmOJ) [141.98.11.11]:55453: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:42:05 dovecot_login authenticator failed for H=(Xu4Qg83QKh) [165.154.217.204]:50848: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:42:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:42:44 dovecot_login authenticator failed for H=(x9cD1nth) [178.16.52.139]:64199: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:42:06 dovecot_login authenticator failed for H=(7d8gR9) [178.16.54.138]:61749: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:43:41 dovecot_login authenticator failed for H=(2ujIbY) [165.154.217.204]:61958: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-02-02 04:43:39 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:41131: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-02-02 04:43:48 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:54044: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:43:22 dovecot_login authenticator failed for H=(xFomD3V5OQ) [165.154.217.204]:59831: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:43:26 dovecot_login authenticator failed for H=(EBrvRwlXj) [158.94.208.175]:60061: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:43:29 dovecot_login authenticator failed for H=(ufsmngW) [141.98.11.11]:65294: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:43:10 dovecot_login authenticator failed for H=(qc1ZpRV) [178.16.54.138]:56771: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:43:12 dovecot_login authenticator failed for H=(mGyXrAdDf) [178.16.52.139]:56995: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:43:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:43:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57619: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 04:43:18 dovecot_plain authenticator failed for H=(hecuping) [176.113.155.132]:42850: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:43:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35432: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:44:19 dovecot_login authenticator failed for H=(byEb4v) [165.154.217.204]:49631: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 04:44:29 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:48796: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-02 04:44:46 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:56492: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:44:10 dovecot_login authenticator failed for H=(N3gow2QBRT) [178.16.52.139]:52384: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:44:17 dovecot_login authenticator failed for H=(JhoVK3X9Wy) [178.16.54.138]:53688: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:44:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:44:32 dovecot_login authenticator failed for H=(T6fr2nLn3) [158.94.208.175]:56684: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:44:08 dovecot_login authenticator failed for H=(g85B50p) [141.98.11.11]:54681: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:44:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59968: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:45:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:45:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42806: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:45:13 dovecot_login authenticator failed for H=(ZMPNZ9mAu) [141.98.11.11]:53544: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:45:22 dovecot_login authenticator failed for H=(Vgp4De) [158.94.208.175]:52698: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:45:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:45:07 dovecot_login authenticator failed for H=(Y8O2f8djOf) [178.16.52.139]:52606: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:45:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:45:17 dovecot_login authenticator failed for H=(jkSFAA) [165.154.217.204]:60482: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:46:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:46:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:46:13 dovecot_login authenticator failed for H=(azHqRRk) [178.16.54.138]:57146: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:46:15 dovecot_login authenticator failed for H=(LARKF8Xxq) [165.154.217.204]:52791: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:46:34 dovecot_login authenticator failed for H=(rR3yO0e6) [141.98.11.11]:60095: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:46:04 dovecot_login authenticator failed for H=(7OclpLyeZ) [178.16.52.139]:62930: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-02 04:46:18 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:40038: 535 Incorrect authentication data (set_id=info@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:46:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63444: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-02-02 04:47:24 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (nuffings) [73.57.80.193]:54956: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 04:47:57 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:26398: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:47:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-02-02 04:47:44 dovecot_login authenticator failed for H=(223-197-145-114.static.imsbiz.com) [223.197.145.114]:61436: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 04:47:49 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:48990: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:47:50 dovecot_login authenticator failed for H=(rY1unvoRo) [165.154.217.204]:62984: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:47:24 dovecot_login authenticator failed for H=(jPwCCDn) [158.94.208.175]:64852: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-02-02 04:47:25 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:38004: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:47:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58120: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:47:12 dovecot_login authenticator failed for H=(tvWRz9Xje) [165.154.217.204]:58350: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:47:14 dovecot_login authenticator failed for H=(Nd3RzBU2Mr) [141.98.11.11]:52177: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:47:15 dovecot_login authenticator failed for H=(MB6NZ0O6H) [178.16.54.138]:65365: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:47:23 dovecot_login authenticator failed for H=(uTf6pdT) [178.16.52.139]:63445: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-02 04:47:53 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:54544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:48:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53360: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:48:16 dovecot_login authenticator failed for H=(gJlzD9afh) [178.16.52.139]:59992: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:48:32 dovecot_login authenticator failed for H=(UitcsDb) [141.98.11.11]:50555: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-02-02 04:48:59 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:49370: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:48:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53249: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:48:09 dovecot_login authenticator failed for H=(1GnTQEPkk6) [165.154.217.204]:65299: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:48:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 04:48:13 +0800] info [cpaneld] 185.204.54.153 - ecrofnam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ecrofnam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:48:19 dovecot_login authenticator failed for H=(3RHOFZ) [178.16.54.138]:60579: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-02 04:48:20 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:50746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:48:33 dovecot_login authenticator failed for H=(6zBnmsUMAf) [158.94.208.175]:52798: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 04:48:50 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:24706: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-02 04:49:17 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:21768: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:49:23 dovecot_login authenticator failed for H=(uQRHYzbHd) [178.16.54.138]:59570: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:49:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:49:06 dovecot_login authenticator failed for H=(EqbPm0) [158.94.208.175]:61750: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:49:10 dovecot_login authenticator failed for H=(8wM1YbEmDf) [141.98.11.11]:62076: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:49:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64304: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:49:07 dovecot_login authenticator failed for H=(X3kaHQ) [178.16.52.139]:56295: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-02 04:49:23 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:56490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.0
country_id: 1643084
description:
[2026-02-02 04:49:30 +0800] info [cpaneld] 95.135.92.0 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:49:09 dovecot_login authenticator failed for H=(FGW2Gz) [165.154.217.204]:53666: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  4:49:43 259984 [Warning] Aborted connection 259984 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 04:49:40 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:57146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 04:49:46 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:44332: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-02-02 04:49:56 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:54906: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:50:06 dovecot_login authenticator failed for H=(AXkL1A6jOr) [165.154.217.204]:58400: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:50:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:50:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59301: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:50:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44078: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:50:25 dovecot_login authenticator failed for H=(vUinx5F3U) [178.16.54.138]:60109: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:50:37 dovecot_login authenticator failed for H=(9SajNT) [141.98.11.11]:59044: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:50:02 dovecot_login authenticator failed for H=(QnEeXGz) [178.16.52.139]:61710: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-02-02 04:50:05 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:54922: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:50:13 dovecot_login authenticator failed for H=(RcUIHsw) [158.94.208.175]:64326: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2026-02-02 04:50:55 dovecot_login authenticator failed for H=([36.135.92.35]) [36.135.92.36]:46056: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2026-02-02 04:50:59 dovecot_login authenticator failed for H=([87.200.94.102]) [87.200.94.102]:45406: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.3.58
country_id: 1814991
description:
2026-02-02 04:51:20 dovecot_login authenticator failed for H=([1.183.3.58]) [1.183.3.58]:55775: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:51:20 dovecot_login authenticator failed for H=(7Tl45nG4) [158.94.208.175]:57341: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:51:04 dovecot_login authenticator failed for H=(paKvHGhcd) [165.154.217.204]:56370: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-02-02 04:51:05 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:46396: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:51:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55136: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:51:24 dovecot_login authenticator failed for H=(kInGd6p) [178.16.54.138]:49966: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:51:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:51:01 dovecot_login authenticator failed for H=(WE4JXI) [178.16.52.139]:59124: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:51:21 dovecot_login authenticator failed for H=(0NsPzFIxd) [141.98.11.11]:54806: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:52:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50285: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:52:04 dovecot_login authenticator failed for H=(ZFVkjl) [178.16.52.139]:52180: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:52:25 dovecot_login authenticator failed for H=(nOYorEE) [178.16.54.138]:54545: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.162
country_id: 2750405
description:
2026-02-02  4:52:52 260094 [Warning] Aborted connection 260094 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.162' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:52:19 dovecot_login authenticator failed for H=(WHgpTuC0B) [165.154.217.204]:57199: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-02-02 04:52:14 dovecot_login authenticator failed for H=([125.17.216.185]) [128.185.246.106]:55234: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:52:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:52:23 dovecot_login authenticator failed for H=(UcrLcbaO) [158.94.208.175]:64338: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:52:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54438: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.234.135.54
country_id: 1562822
description:
2026-02-02 04:52:32 dovecot_login authenticator failed for H=(125.234.135.54.hcm.viettel.vn) [125.234.135.54]:60370: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:52:38 dovecot_login authenticator failed for H=(0YS6pex0u) [165.154.217.204]:49430: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:52:01 dovecot_login authenticator failed for H=(A3kPlWfhk) [141.98.11.11]:49824: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:53:23 dovecot_login authenticator failed for H=(ZUFY63vtTw) [141.98.11.11]:61385: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:53:29 dovecot_login authenticator failed for H=(lKcx20BiuQ) [158.94.208.175]:56737: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:53:16 dovecot_login authenticator failed for H=(yzSq2C) [165.154.217.204]:53679: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.119.163
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2752 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:53:02 dovecot_login authenticator failed for H=(a4DE4c) [178.16.52.139]:55971: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:53:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63844: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:53:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:53:27 dovecot_login authenticator failed for H=(V7BUNK) [178.16.54.138]:60275: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 181.117.8.241
country_id: 3865483
domain: oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/130.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:54:08 dovecot_login authenticator failed for H=(pCVlAviz7) [141.98.11.11]:50224: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 04:54:47 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:51110: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:54:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 181.117.8.241
country_id: 3865483
description:
Feb  2 04:54:00 sv3 pure-ftpd[1416165]: (?@181.117.8.241) [WARNING] Authentication failed for user [steven@oxbold.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.8.241
country_id: 3865483
description:
2026-02-02 04:54:10 dovecot_plain authenticator failed for H=(DESKTOP-D6RI6JH) [181.117.8.241]:37697: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:54:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55502: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-02 04:54:20 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:33074: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:54:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49908: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 181.117.8.241
country_id: 3865483
description:
Feb  2 04:54:46 sv3 pure-ftpd[1416592]: (?@181.117.8.241) [WARNING] Authentication failed for user [steven]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:54:13 dovecot_login authenticator failed for H=(AKm4qu) [165.154.217.204]:53248: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 04:54:36 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:43161: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:54:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:54:23 dovecot_login authenticator failed for H=(GYR9xtRp9) [178.16.52.139]:61126: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:55:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65041: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:55:12 dovecot_login authenticator failed for H=(YQ368HD) [141.98.11.11]:58013: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 04:56:01 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:19127: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 181.117.8.241
country_id: 3865483
description:
Feb  2 04:55:01 sv3 pure-ftpd[1416825]: (?@181.117.8.241) [WARNING] Authentication failed for user [oxbold]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.8.241
country_id: 3865483
description:
2026-02-02 04:55:04 dovecot_plain authenticator failed for H=(DESKTOP-D6RI6JH) [181.117.8.241]:41033: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:55:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:55:01 dovecot_login authenticator failed for H=(ay8Pig) [158.94.208.175]:65350: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:55:11 dovecot_login authenticator failed for H=(AHu1xVYD) [165.154.217.204]:57515: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-02 04:55:08 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:54306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:55:15 dovecot_login authenticator failed for H=(PmPbabE) [178.16.52.139]:60178: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:56:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52326: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:56:49 dovecot_login authenticator failed for H=(1dIWDJJ) [158.94.208.175]:63590: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:56:07 dovecot_login authenticator failed for H=(MmMdmGHxE) [178.16.52.139]:60438: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:56:08 dovecot_login authenticator failed for H=(vKHm9S8TKf) [165.154.217.204]:63488: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:56:13 dovecot_login authenticator failed for H=(hbhC8BdBAI) [178.16.54.138]:54553: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 04:56:40 H=(localhost.localdomain) [78.153.140.207]:56422 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:56:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52488: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:56:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 04:56:18 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:36500: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:56:18 dovecot_login authenticator failed for H=(D06e2Oo) [141.98.11.11]:54173: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.8.241
country_id: 3865483
description:
2026-02-02 04:56:20 dovecot_plain authenticator failed for H=(DESKTOP-D6RI6JH) [181.117.8.241]:46200: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:56:47 dovecot_login authenticator failed for H=(qB4bkQv) [165.154.217.204]:65488: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:57:22 dovecot_login authenticator failed for H=(aTKA3MUu) [158.94.208.175]:51203: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:57:24 dovecot_login authenticator failed for H=(EcW7Ymhs) [178.16.52.139]:51202: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:57:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63857: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 04:57:52 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:25332: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:57:06 dovecot_login authenticator failed for H=(1zgzoS) [165.154.217.204]:51157: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:57:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-02 04:57:39 dovecot_login authenticator failed for H=([122.187.230.104]) [122.187.230.104]:45756: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-02-02 04:58:03 dovecot_login authenticator failed for H=([125.19.196.207]) [27.123.104.142]:38298: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.126
country_id: 1668284
description:
2026-02-02 04:58:16 dovecot_login authenticator failed for H=111-70-32-126.emome-ip.hinet.net [111.70.32.126]:52025: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:58:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:58:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:58:21 dovecot_login authenticator failed for H=(41v88msqV) [158.94.208.175]:65194: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:58:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.162
country_id: 2750405
description:
2026-02-02  4:58:50 260301 [Warning] Aborted connection 260301 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.162' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:58:03 dovecot_login authenticator failed for H=(pUHgH7XuP2) [165.154.217.204]:62531: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:59:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36306: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:58:15 dovecot_login authenticator failed for H=(2mhD6V12B) [178.16.54.138]:55458: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:58:16 dovecot_login authenticator failed for H=(5rSFErkGB) [178.16.52.139]:54627: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:59:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:59:14 dovecot_login authenticator failed for H=(6OT4RLj) [178.16.54.138]:60000: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:59:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:59:20 dovecot_login authenticator failed for H=(gmHP3we) [165.154.217.204]:51808: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:59:22 dovecot_login authenticator failed for H=(i4zsCC0) [158.94.208.175]:64106: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-02 04:59:32 dovecot_plain authenticator failed for H=(excars) [102.53.15.180]:11547: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:59:08 dovecot_login authenticator failed for H=(TZ6jGWI5) [178.16.52.139]:57644: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:59:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52111: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:00:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61928: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.170.98.175
country_id: 1814991
description:
2026-02-02 05:00:14 dovecot_login authenticator failed for H=([127.0.0.1]) [175.170.98.175]:41160: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:00:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:00:19 dovecot_login authenticator failed for H=(Gw9Ply3d) [178.16.54.138]:58928: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 05:00:31 H=(localhost.localdomain) [78.153.140.207]:34430 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:00:13 dovecot_login authenticator failed for H=(0hWKGcajh) [178.16.52.139]:54983: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:00:17 dovecot_login authenticator failed for H=(KpEAj91) [165.154.217.204]:62003: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.93.205
country_id: 1168579
description:
2026-02-02 05:00:20 dovecot_login authenticator failed for H=([127.0.0.1]) [163.223.93.205]:54345: 535 Incorrect authentication data (set_id=meemee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:00:25 dovecot_login authenticator failed for H=(mCFJmyd) [69.5.189.21]:55047: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:00:29 dovecot_login authenticator failed for H=(wjQvV9) [158.94.208.175]:64929: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:01:12 dovecot_login authenticator failed for H=(nnAuqO6t) [69.5.189.21]:63147: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:01:27 dovecot_login authenticator failed for H=(6ISv1Z55) [178.16.54.138]:53460: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:01:34 dovecot_login authenticator failed for H=(ym4DQQKXt) [165.154.217.204]:49222: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:01:06 dovecot_login authenticator failed for H=(ZN0Den) [158.94.208.175]:58439: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:01:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47702: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:01:15 dovecot_login authenticator failed for H=(pNGfkyvDGX) [165.154.217.204]:52038: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:01:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55516: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:01:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-02 05:01:16 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:49826: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:01:11 dovecot_login authenticator failed for H=(VCt5qGyM) [178.16.52.139]:61731: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 05:01:27 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:37808: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:02:11 dovecot_login authenticator failed for H=(W3dpJiPHJl) [178.16.52.139]:62911: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:02:29 dovecot_login authenticator failed for H=(ZWYOxCk) [178.16.54.138]:64495: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:02:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58065: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.73
country_id: 1210997
description:
2026-02-02 05:02:43 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [210.4.68.73]:59666: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:02:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:02:12 dovecot_login authenticator failed for H=(z7yBmUGl) [165.154.217.204]:60095: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:02:13 dovecot_login authenticator failed for H=(QpRmcUIz) [158.94.208.175]:52156: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:02:22 dovecot_login authenticator failed for H=(P06g6Ga) [69.5.189.21]:58401: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-02-02 05:02:59 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:20711: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-02-02 05:03:16 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:32872: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:03:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45148: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.195.168.139
country_id: 2802361
description:
2026-02-02  5:03:16 260444 [Warning] Aborted connection 260444 to db: 'unconnected' user: 'unauthenticated' host: '35.195.168.139' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:03:21 dovecot_login authenticator failed for H=(woYto7EC6u) [158.94.208.175]:53817: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:03:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57641: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:03:23 dovecot_login authenticator failed for H=(tXSp2qQA5) [178.16.52.139]:54140: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:03:09 dovecot_login authenticator failed for H=(s1ZY5q6Y) [165.154.217.204]:59878: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 05:03:12 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:39445: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:03:31 dovecot_login authenticator failed for H=(13BtZ5c) [178.16.54.138]:51610: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-02 05:03:36 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:33448: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:03:09 dovecot_login authenticator failed for H=(nfMHahOj6) [69.5.189.21]:49879: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:04:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51633: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:04:26 dovecot_login authenticator failed for H=(emwpBN) [158.94.208.175]:63975: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:04:34 dovecot_login authenticator failed for H=(tETYNF) [178.16.54.138]:50090: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:04:44 dovecot_login authenticator failed for H=(OBwith7v) [178.16.52.139]:54081: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.57.77
country_id: 1269750
domain: fimco.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11748.fimco.com.my||ServerName:fimco.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba9e3cea8a342692de61ac37a265f26740be5b2a||Title:0xb0e26059||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:04:18 dovecot_login authenticator failed for H=(08GMr1l0) [165.154.217.204]:49504: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:04:18 dovecot_login authenticator failed for H=(PJmH7b7WA) [69.5.189.21]:54662: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:04:36 dovecot_login authenticator failed for H=(Dg83ZMyPx) [165.154.217.204]:65422: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.185.205.5
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27289.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:35118f31b48a7b3a797f6e9b21155b538663790d||Title:0x1cc6c629||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:06:02 dovecot_login authenticator failed for H=(YDsy8kVtn9) [158.94.208.175]:55712: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:05:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36714: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:05:05 dovecot_login authenticator failed for H=(YTLGssdTQ0) [69.5.189.21]:63712: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:05:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61601: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:05:10 dovecot_login authenticator failed for H=(1zhsEP3) [178.16.52.139]:53079: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:05:14 dovecot_login authenticator failed for H=(qKkIqyV) [165.154.217.204]:63136: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: vc-b.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/vcbcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-02-02 05:06:34 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:45916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:06:35 dovecot_login authenticator failed for H=(EKgl0s) [158.94.208.175]:59863: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 05:06:53 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:39892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:06:53 dovecot_login authenticator failed for H=(23RMxEK7ts) [165.154.217.204]:51500: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:06:12 dovecot_login authenticator failed for H=(ovWndm) [165.154.217.204]:54971: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:06:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56180: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.94.65
country_id: 1814991
description:
2026-02-02 05:06:25 dovecot_login authenticator failed for H=([114.250.94.65]) [114.250.94.65]:25587: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:06:27 dovecot_login authenticator failed for H=(rBGEzKNdO) [178.16.52.139]:54846: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:06:29 dovecot_login authenticator failed for H=(QeLRqo9) [178.16.54.138]:62908: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 05:06:43 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:36494: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: vc-b.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/vcbcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:07:10 dovecot_login authenticator failed for H=(QmwwibkZ) [165.154.217.204]:52735: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:07:33 dovecot_login authenticator failed for H=(gubqd0Q) [178.16.54.138]:57826: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 05:07:42 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:28808: 535 Incorrect authentication data


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:' or '1'='1' union select null,'<script>alert(1)</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat /etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:__waf_test__||MV:' OR '1'='1' UNION SELECT NULL,'<script>alert(1)</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat /etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:07:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58278: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:07:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49276: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:07:07 dovecot_login authenticator failed for H=(uSKjf6Jymq) [158.94.208.175]:56685: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:07:22 dovecot_login authenticator failed for H=(m9GATeW8g) [178.16.52.139]:54104: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:__waf_test__||MV:' OR '1'='1' UNION SELECT NULL,'<script>alert(1)</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat /etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 05:07:52 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:41422: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:08:48 dovecot_login authenticator failed for H=(t9WIUFSXBb) [158.94.208.175]:57925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:08:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:08:16 dovecot_login authenticator failed for H=(3z1vQH59nS) [178.16.52.139]:61931: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 05:08:30 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:45758: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-02-02  5:08:52 260780 [Warning] Aborted connection 260780 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'extractvalue(1298,concat(0x7e,(select/**/(elt(1298=1298,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-02 05:08:20 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:41854: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/9888=CAST('~'||(SELECT/**/(CASE/**/WHEN/**/(9888=9888)/**/THEN/**/1/**/ELSE/**/0/**/END))::text||'~'/**/AS/**/NUMERIC)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:08:07 dovecot_login authenticator failed for H=(Nvl8u9) [165.154.217.204]:58815: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:08:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51983: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:09:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60760: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:09:14 dovecot_login authenticator failed for H=(4hEtQDQqYA) [178.16.52.139]:56292: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND EXTRACTVALUE(9654,CONCAT(0x7e,(SELECT/**/(ELT(9654=9654,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND AND/**/2670/**/IN/**/(SELECT/**/('~' (SELECT/**/(CASE/**/WHEN/**/(2670=2670)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:09:36 dovecot_login authenticator failed for H=(0Vw2qL5Z) [158.94.208.175]:51234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-02-02 05:09:48 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:59088: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:09:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:09:04 dovecot_login authenticator failed for H=(Vn0eVjgHG4) [165.154.217.204]:54762: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and extractvalue(9654,concat(0x7e,(select/**/(elt(9654=9654,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and and/**/2670/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(2670=2670)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 82.165.89.172
country_id: 2921044
description:
Feb  2 05:09:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account prayerlink@agpc.org.my has been temporarily locked by Imunify PAM(82.165.89.172)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.165.89.172
country_id: 2921044
description:
2026-02-02 05:09:58 dovecot_plain authenticator failed for H=infong-eu-cl0113.clienthosting.eu (mmvnzp4s12rdynrzl0i76wvhx) [82.165.89.172]:45812: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:09:07 dovecot_login authenticator failed for H=(KcpM0E0) [165.154.217.204]:55402: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:09:28 dovecot_login authenticator failed for H=(ta5X0hlSL) [178.16.54.138]:50369: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:09:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52112: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:10:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:10:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55776: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/(SELECT/**/4045/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(4045=4045,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/(SELECT/**/7968/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7968=7968,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/1792=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1792=1792)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 05:10:04 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:34318: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 05:10:15 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:56574: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1) AND /*!50000AND*/(/*!50000SELECT*/3142/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3142=3142,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:10:09 dovecot_login authenticator failed for H=(W1FENO) [158.94.208.175]:55704: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(8791,CONCAT(0x7e,(SELECT/**/(ELT(8791=8791,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/1792=cast(('~'||(select/**/(case/**/when/**/(1792=1792)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/9905=(select/**/upper(xmltype(chr(60)||chr(58)||%27~%27||(select/**/(case/**/when/**/(9905=9905)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(62)))/**/from/**/dual)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND /*!50000AND*/(/*!50000SELECT*/3142/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3142=3142,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/(select/**/4045/**/from(select/**/count(*),concat('~',(select/**/(elt(4045=4045,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/7968/**/from(select/**/count(*),concat('~',(select/**/(elt(7968=7968,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:10:04 dovecot_login authenticator failed for H=(Lhidve) [165.154.217.204]:53765: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1) AND /*!50000AND*/(/*!50000SELECT*/3142/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3142=3142,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/7968/**/from(select/**/count(*),concat('~',(select/**/(elt(7968=7968,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1AND/**/(SELECT/**/7968/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7968=7968,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)#||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:10:29 dovecot_login authenticator failed for H=(8PxOHSTpDd) [178.16.52.139]:64500: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1))and/**/(select/**/7953/**/from(select/**/count(*),concat('~',(select/**/(elt(7953=7953,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((7422=7422||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1AND/**/(SELECT/**/7968/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7968=7968,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1 AND AND/**/(SELECT/**/4045/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(4045=4045,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1))and/**/(select/**/7953/**/from(select/**/count(*),concat('~',(select/**/(elt(7953=7953,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((7422=7422||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:11:19 dovecot_login authenticator failed for H=(PB0U4e) [165.154.217.204]:50999: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))/*!50000AND*/(/*!50000SELECT*/5050/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5050=5050,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (('y35TCQiO'='y35TCQiO||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.0.132.237
country_id: 6251999
description:
2026-02-02 05:11:03 dovecot_login authenticator failed for H=([127.0.0.1]) [135.0.132.237]:36847: 535 Incorrect authentication data (set_id=arts@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:11:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:11:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39672: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))/*!50000AND*/(/*!50000SELECT*/5050/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5050=5050,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (('y35TCQiO'='y35TCQiO||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/1627=cast(('~'||(select/**/(case/**/when/**/(1627=1627)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.24.14
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=658383 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/(SELECT/**/9420/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9420=9420,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:11:02 dovecot_login authenticator failed for H=(obKY24IlVd) [165.154.217.204]:65399: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.140
country_id: 2661886
description:
2026-02-02 05:11:11 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.140]:49776: 535 Incorrect authentication data (set_id=arts)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND AND/**/(SELECT/**/9420/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9420=9420,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'))/*!50000AND*/(/*!50000SELECT*/5050/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5050=5050,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (('y35TCQiO'='y35TCQiO||RSV:7.71||T:APACHE||


