# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:45:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:45:19 dovecot_login authenticator failed for H=(DSgCM8) [165.154.235.122]:51757: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.5.32
country_id: 1562822
description:
2026-02-02 14:45:44 H=([160.250.5.32]) [160.250.5.32]:58079 F=<leonqdop08@leon-logistics.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 160.250.5.32 is not allowed to send mail from leon-logistics.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:45:54 dovecot_login authenticator failed for H=(89kFpFh) [178.16.54.138]:63125: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:45:02 dovecot_login authenticator failed for H=(POQnClD) [178.16.52.139]:53653: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:45:17 dovecot_login authenticator failed for H=(dAvbAD) [165.154.254.163]:57300: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:45:29 dovecot_login authenticator failed for H=(HXJue9wDI) [158.94.208.175]:58886: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:45:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61735: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:46:57 dovecot_login authenticator failed for H=(m3nYBhjnt) [178.16.54.138]:61042: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:46:58 dovecot_login authenticator failed for H=(Tw5KR8w) [165.154.235.122]:57410: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:46:15 dovecot_login authenticator failed for H=(UjTLI0) [165.154.254.163]:51251: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.188.24
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/brand.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:46:26 dovecot_login authenticator failed for H=(JpsRRiGGh) [158.94.208.175]:60989: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:46:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57517: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:46:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48114: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:46:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:46:17 dovecot_login authenticator failed for H=(dowawde) [165.154.235.122]:50831: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:46:23 dovecot_login authenticator failed for H=(DHGdTmV) [178.16.52.139]:64501: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:47:15 dovecot_login authenticator failed for H=(8xtpeS4hg) [165.154.254.163]:61826: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 14:47:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:47:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52988: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-02-02 14:47:17 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:47:29 dovecot_login authenticator failed for H=(nrSoiB) [158.94.208.175]:54457: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 14:47:07 H=([167.148.167.71]) [167.148.167.71]:62936 F=<Suport@tschuan.com> rejected RCPT <chuan@tschuan.com>: SPF: 167.148.167.71 is not allowed to send mail from tschuan.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:47:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:47:16 dovecot_login authenticator failed for H=(Jk4xmE) [178.16.52.139]:61822: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:47:18 dovecot_login authenticator failed for H=(BE6yeSU) [165.154.235.122]:64697: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.17.45
country_id: 6252001
description:
2026-02-02 14:48:00 dovecot_login authenticator failed for H=([72.250.17.45]) [72.250.17.45]:51932: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:48:15 dovecot_login authenticator failed for H=(PoRFr7W5EE) [165.154.254.163]:56727: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 14:48:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-02-02 14:48:43 dovecot_login authenticator failed for H=(98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:48678: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-02-02 14:48:56 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:42902: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:49:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56942: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.84.70
country_id: 2017370
description:
2026-02-02 14:48:07 dovecot_login authenticator failed for H=(95-165-84-70.dynamic.spd-mgts.ru) [95.165.84.70]:55332: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:48:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:48:13 dovecot_login authenticator failed for H=(VZKh2gox9c) [178.16.52.139]:59844: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:48:17 dovecot_login authenticator failed for H=(i4EUHvPE) [165.154.235.122]:58021: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:48:33 dovecot_login authenticator failed for H=(5faDuGJUQu) [158.94.208.175]:55850: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:48:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50564: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:49:14 dovecot_login authenticator failed for H=(SVuOVI) [158.94.208.175]:60310: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:49:21 dovecot_login authenticator failed for H=(rD8Ht0X) [165.154.254.163]:52776: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:49:04 dovecot_login authenticator failed for H=(yuHahi) [165.154.235.122]:58828: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.84
country_id: 3624060
description:
2026-02-02 14:49:20 dovecot_login authenticator failed for H=([127.0.0.1]) [186.177.88.84]:60749: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:49:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63306: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:49:05 dovecot_login authenticator failed for H=(TUtVnNxo) [178.16.54.138]:60686: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:49:07 dovecot_login authenticator failed for H=(hx5Ugu9) [178.16.52.139]:62930: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 14:49:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.88
country_id: 6252001
description:
2026-02-02 14:49:28 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.88]:37362: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:49:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:49:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:50:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58816: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:50:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:50:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:50:10 dovecot_login authenticator failed for H=(v0poaTu7) [178.16.54.138]:61686: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:50:24 dovecot_login authenticator failed for H=(9U9p5HuX) [178.16.52.139]:54610: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 14:50:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:50:34 dovecot_login authenticator failed for H=(GgVPkse) [158.94.208.175]:62848: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:50:04 dovecot_login authenticator failed for H=(fQso79rvn) [165.154.254.163]:61219: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:50:05 dovecot_login authenticator failed for H=(6wzJPU9) [165.154.235.122]:58455: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:51:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:51:20 dovecot_login authenticator failed for H=(om8QEdGD) [178.16.52.139]:52341: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:51:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53284: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:51:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:51:42 dovecot_login authenticator failed for H=(cUPHX8) [165.154.254.163]:64950: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:51:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 14:51:52 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unwicimism) [87.103.126.54]:24767: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:51:06 dovecot_login authenticator failed for H=(qmt4NRIQ) [165.154.235.122]:61451: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 14:51:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:51:16 dovecot_login authenticator failed for H=(iqn187zxC) [178.16.54.138]:49414: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:51:03 dovecot_login authenticator failed for H=(jiVRBo1) [165.154.254.163]:57288: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:51:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37924: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:51:12 dovecot_login authenticator failed for H=(cLpEOa8k53) [158.94.208.175]:64851: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:52:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:52:05 dovecot_login authenticator failed for H=(8L9U7tq4O) [165.154.235.122]:55869: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:52:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:52:16 dovecot_login authenticator failed for H=(8vthlR) [158.94.208.175]:56117: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:52:20 dovecot_login authenticator failed for H=(jorPUhXn) [165.154.254.163]:56636: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:52:11 dovecot_login authenticator failed for H=(bsKcuvG) [178.16.52.139]:49223: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:52:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65379: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:52:20 dovecot_login authenticator failed for H=(WZtwAcN9bi) [178.16.54.138]:56493: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:52:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:53:26 dovecot_login authenticator failed for H=(lwFzDE5Q) [178.16.52.139]:49901: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:53:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60315: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:53:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:53:18 dovecot_login authenticator failed for H=(Zo4z67) [165.154.254.163]:52222: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:53:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:53:25 dovecot_login authenticator failed for H=(gURTTBS2zY) [178.16.54.138]:58582: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:53:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:53:04 dovecot_login authenticator failed for H=(WEVRgr) [165.154.235.122]:60563: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:53:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37702: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:53:18 dovecot_login authenticator failed for H=(rMF9xQNqH) [158.94.208.175]:65529: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:54:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:54:04 dovecot_login authenticator failed for H=(vUFtRVkz5) [165.154.235.122]:64176: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 14:54:11 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:59399: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.70.97
country_id: 3017382
description:
[2026-02-02 14:54:49 +0800] info [cpaneld] 138.124.70.97 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-02 14:54:59 dovecot_plain authenticator failed for H=(brete) [12.150.243.22]:54109: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:54:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54313: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:54:15 dovecot_login authenticator failed for H=(zVS9zQm14) [178.16.52.139]:60962: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:54:24 dovecot_login authenticator failed for H=(uVMIRp) [158.94.208.175]:56628: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:54:22 dovecot_login authenticator failed for H=(mz4whYAKrq) [165.154.254.163]:64911: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:54:37 dovecot_login authenticator failed for H=(nq7XDG) [178.16.54.138]:56868: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:55:08 dovecot_login authenticator failed for H=(xcHESr4Cw) [165.154.235.122]:50775: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:55:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:55:24 dovecot_login authenticator failed for H=(Avz6OF) [165.154.254.163]:60965: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:55:32 dovecot_login authenticator failed for H=(YSV6Eea) [158.94.208.175]:59533: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:55:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58870: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:55:39 dovecot_login authenticator failed for H=(GxEtBrCnOH) [178.16.54.138]:62665: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:55:15 dovecot_login authenticator failed for H=(BCwXkb6m1) [178.16.52.139]:65055: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:55:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49516: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:56:03 dovecot_login authenticator failed for H=(DMj6a14) [165.154.254.163]:52990: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:56:03 dovecot_login authenticator failed for H=(ZvwlSSC1a) [158.94.208.175]:60701: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:56:40 dovecot_login authenticator failed for H=(oMjVww) [178.16.54.138]:55411: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:56:09 dovecot_login authenticator failed for H=(HvN9llESy) [165.154.235.122]:59451: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:56:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60662: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:56:29 dovecot_login authenticator failed for H=(Uj169jZ2D) [165.154.235.122]:51479: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:56:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:57:47 dovecot_login authenticator failed for H=(FcfpzRX6J) [178.16.54.138]:51369: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 14:57:06 +0800] info [cpaneld] 185.204.54.153 - dnek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dnek (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:57:09 dovecot_login authenticator failed for H=(Gy8vQpn50Y) [165.154.235.122]:64529: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:57:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56486: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:57:05 dovecot_login authenticator failed for H=(jJHSborN) [165.154.254.163]:64523: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:57:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56512: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:57:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:58:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60085: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:58:11 dovecot_login authenticator failed for H=(cxSkg3) [165.154.235.122]:57349: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-02-02 14:58:14 dovecot_login authenticator failed for H=([203.172.213.166]) [203.172.213.166]:37080: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2026-02-02 14:58:24 dovecot_login authenticator failed for H=(74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:52238: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:58:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:58:09 dovecot_login authenticator failed for H=(Gt7tGQSTa) [165.154.254.163]:61666: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74753.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e277b575ae0de5ee8857494c032d2f3ed3708af||Title:0x9ec8a111||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:58:48 dovecot_login authenticator failed for H=(hcJTm9dh5b) [178.16.54.138]:62501: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:59:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52463: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:59:11 dovecot_login authenticator failed for H=(hRGivRTC) [165.154.254.163]:58179: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.222.225.129
country_id: 1269750
domain: maalloys.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55585.maalloys.com.my||ServerName:maalloys.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6f0698a0259ad3c3fc0b7a5a5caa415ef64e7a6d||Title:0x659840c7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:59:11 dovecot_login authenticator failed for H=(CMXDXZ3Yp) [165.154.235.122]:56806: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:59:06 dovecot_login authenticator failed for H=(LoxndD) [158.94.208.175]:55591: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 14:59:25 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:59:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40536: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:59:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-02-02 14:59:52 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:57900: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-02-02 14:59:55 +0800] info [cpaneld] 62.171.146.247 - kendek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:59:55 dovecot_login authenticator failed for H=(I04AFU) [178.16.54.138]:52170: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-02-02 15:00:00 dovecot_login authenticator failed for H=([128.185.246.106]) [128.185.246.106]:35426: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.214.160.4
country_id: 2017370
description:
2026-02-02 15:00:01 dovecot_login authenticator failed for H=(pool.luganet.ru) [178.214.160.4]:53838: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:59:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:00:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63134: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:01:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24194: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:00:17 dovecot_login authenticator failed for H=(4j4XsuR) [165.154.235.122]:50637: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:00:14 dovecot_login authenticator failed for H=(9lG5Fqlk) [165.154.254.163]:53595: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:00:10 dovecot_login authenticator failed for H=(3Womyx89) [158.94.208.175]:51315: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:00:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:00:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:01:00 dovecot_login authenticator failed for H=(EeEVXIRds) [165.154.254.163]:62092: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:01:04 dovecot_login authenticator failed for H=(WUixlUk) [178.16.54.138]:65417: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:01:20 dovecot_login authenticator failed for H=(9Dk67TTelo) [165.154.254.163]:50668: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 15:02:00 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:49719: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:01:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24194: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:01:20 dovecot_login authenticator failed for H=(feYd18YO) [165.154.235.122]:57024: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:01:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:01:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57281: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:01:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43910: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:01:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:01:42 dovecot_login authenticator failed for H=(A9Gm9g6rz) [158.94.208.175]:61527: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:02:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52666: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 15:02:30 293984 [Warning] Aborted connection 293984 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47796: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:02:09 dovecot_login authenticator failed for H=(FKJ1iny1tA) [178.16.54.138]:55735: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:02:14 dovecot_login authenticator failed for H=(Op94RMmhb) [158.94.208.175]:49497: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:02:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:02:20 dovecot_login authenticator failed for H=(Lsvc7pG778) [165.154.235.122]:65114: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:02:19 dovecot_login authenticator failed for H=(T6vzX7R) [165.154.254.163]:62286: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:03:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:03:21 dovecot_login authenticator failed for H=(8qL9vs) [165.154.254.163]:57572: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:03:23 dovecot_login authenticator failed for H=(KB3xf54za) [158.94.208.175]:54753: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:03:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50341: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/autoloader.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:03:17 dovecot_login authenticator failed for H=(ljpMyr) [178.16.54.138]:51174: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:03:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43238: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:03:22 dovecot_login authenticator failed for H=(tQZOhlFk6) [165.154.235.122]:50224: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:03:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47796: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:04:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:04:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63020: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:04:28 dovecot_login authenticator failed for H=(OiOCeC) [158.94.208.175]:52377: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/library/SimplePie/Content/Type/Sniffer.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:04:20 dovecot_login authenticator failed for H=(NJNm19) [165.154.235.122]:51950: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:04:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:04:22 dovecot_login authenticator failed for H=(6T3hPxiI) [178.16.54.138]:60258: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:04:19 dovecot_login authenticator failed for H=(tDWlw7HT6) [165.154.254.163]:52905: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:05:20 dovecot_login authenticator failed for H=(B1n2wR) [165.154.235.122]:53509: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/src/Cache/Base.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:05:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58334: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:05:41 dovecot_login authenticator failed for H=(29VSCYK) [165.154.235.122]:59535: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:05:30 dovecot_login authenticator failed for H=(EuH5Bk) [158.94.208.175]:58542: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 136.144.42.71
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:05:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52586: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:05:20 dovecot_login authenticator failed for H=(ASwsp0aYt) [165.154.254.163]:49279: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:05:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:05:32 dovecot_login authenticator failed for H=(yadpYO0) [178.16.54.138]:61013: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 136.144.42.89
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-includes/id3/license.txt/wp1/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 136.144.42.135
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-includes/id3/license.txt/cms/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:06:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63381: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home2/woh/box.com.my/wp-includes/assets/script-loader-packages.min.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:06:22 dovecot_login authenticator failed for H=(9yb6fL3) [165.154.254.163]:59942: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:06:35 dovecot_login authenticator failed for H=(C8BTgL) [178.16.54.138]:60300: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/src/XML/Declaration/Parser.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:06:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:06:22 dovecot_login authenticator failed for H=(2DbpxQ) [165.154.235.122]:55347: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:06:03 dovecot_login authenticator failed for H=(uvoDF1) [158.94.208.175]:54484: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:07:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55540: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:07:12 dovecot_login authenticator failed for H=(8Rq7Q8C) [158.94.208.175]:52053: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:07:02 dovecot_login authenticator failed for H=(uxZZxoJFg) [165.154.235.122]:49492: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:07:19 dovecot_login authenticator failed for H=(bmn65D63hB) [165.154.254.163]:53584: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:07:41 dovecot_login authenticator failed for H=(aB91Cy) [178.16.54.138]:61735: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:07:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:07:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:08:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:08:18 dovecot_login authenticator failed for H=(0n3VER) [165.154.254.163]:64141: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:08:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37440: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:08:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:08:20 dovecot_login authenticator failed for H=(KDjAAhT) [165.154.235.122]:53339: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:08:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51703: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:08:11 dovecot_login authenticator failed for H=(eDspg5N6g) [158.94.208.175]:52372: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:09:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.201.195.219
country_id: 1694008
domain: manforce.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94522.manforce.net||ServerName:manforce.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee642d318e18980d50dc5a20c8e651740db88f88||Title:0x8b81145c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-02-02 15:09:43 dovecot_login authenticator failed for H=([103.250.160.76]) [103.250.160.76]:53776: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:09:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:09:09 dovecot_login authenticator failed for H=(a72tRA) [158.94.208.175]:55564: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:09:16 dovecot_login authenticator failed for H=(nQvGLOyfG) [165.154.254.163]:57974: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 15:10:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58518: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:09:20 dovecot_login authenticator failed for H=(wWTEGdaF) [165.154.235.122]:65098: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:09:36 dovecot_login authenticator failed for H=(5rJzuFxFql) [165.154.254.163]:61154: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:09:50 dovecot_login authenticator failed for H=(MAAaMYIp) [178.16.54.138]:60623: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-02-02 15:09:58 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:57186: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:09:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63282: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:10:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42572: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:10:18 dovecot_login authenticator failed for H=(cfUaYS) [165.154.235.122]:64177: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 15:10:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58518: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:10:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57925: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:10:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:10:15 dovecot_login authenticator failed for H=(B5TKlM) [165.154.254.163]:51521: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:11:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53334: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2026-02-02 15:11:13 dovecot_plain authenticator failed for H=c-73-0-235-30.hsd1.fl.comcast.net (iding) [73.0.235.30]:45860: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-02-02 15:11:09 dovecot_plain authenticator failed for H=ool-457bdb52.dyn.optonline.net (ophoopar) [69.123.219.82]:59992: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:11:12 dovecot_login authenticator failed for H=(5oQ9Wd) [165.154.254.163]:61844: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:11:57 dovecot_login authenticator failed for H=(zmLJFP) [178.16.54.138]:59152: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:11:21 dovecot_login authenticator failed for H=(7iP4NxiIR) [158.94.208.175]:64490: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:11:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:11:16 dovecot_login authenticator failed for H=(rtTTrJ) [165.154.235.122]:56435: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:12:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:12:11 dovecot_login authenticator failed for H=(hD5Xdw) [165.154.254.163]:55361: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:12:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42822: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:12:15 dovecot_login authenticator failed for H=(UAcRnoOa) [165.154.235.122]:56987: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:12:19 dovecot_login authenticator failed for H=(khIrxm) [158.94.208.175]:50279: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.160.14.57
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=66351520647724 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:12:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59216: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.56.17
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/iso-standards.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.222.41.67
country_id: 1814991
description:
2026-02-02 15:12:53 dovecot_login authenticator failed for H=([183.222.41.67]) [183.222.41.67]:42252: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:13:48 dovecot_login authenticator failed for H=(E8j3gCWk) [158.94.208.175]:52304: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:13:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53719: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:13:54 dovecot_login authenticator failed for H=(x5SBJkAvM) [165.154.235.122]:64057: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:13:15 dovecot_login authenticator failed for H=(e0UkaqcAnr) [165.154.235.122]:49174: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:13:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-02-02 15:13:18 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:41116: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:13:03 dovecot_login authenticator failed for H=(Q8i6tTOqWy) [178.16.54.138]:64837: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:13:09 dovecot_login authenticator failed for H=(CdhqVtwX3I) [165.154.254.163]:65175: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:14:13 dovecot_login authenticator failed for H=(pP9mH2zL) [165.154.235.122]:58691: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.70.190
country_id: 1282988
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/sv/functions HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:14:17 dovecot_login authenticator failed for H=(BUVgjv7mhl) [158.94.208.175]:60504: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:14:06 dovecot_login authenticator failed for H=(oPnU6PO7C) [165.154.254.163]:58720: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:14:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:14:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59086: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:14:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65520: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:15:12 dovecot_login authenticator failed for H=(Wfp8UtSKz) [165.154.235.122]:56331: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:15:15 dovecot_login authenticator failed for H=(UZUbgM6) [178.16.54.138]:56477: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:15:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61657: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:15:54 dovecot_login authenticator failed for H=(Xl8Yz0aOf) [158.94.208.175]:65051: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:16:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:15:04 dovecot_login authenticator failed for H=(JL2vOjfD7) [165.154.254.163]:52408: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:15:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:16:02 dovecot_login authenticator failed for H=(YzijPbh) [165.154.254.163]:62127: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:16:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:16:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:16:11 dovecot_login authenticator failed for H=(rYqE1yJ) [165.154.235.122]:52298: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:16:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57255: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:16:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55490: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:16:18 dovecot_login authenticator failed for H=(7xy6Oqye) [178.16.54.138]:49752: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 15:16:19 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58529: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:16:37 dovecot_login authenticator failed for H=(snyjrsY) [158.94.208.175]:49883: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:17:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50777: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:17:25 dovecot_login authenticator failed for H=(lOJ8JzsD) [178.16.54.138]:59123: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:17:09 dovecot_login authenticator failed for H=(RpVUyujIMf) [165.154.235.122]:51361: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:17:20 dovecot_login authenticator failed for H=(OSTVJD) [165.154.254.163]:59694: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:17:33 dovecot_login authenticator failed for H=(Ad3BIYq) [158.94.208.175]:60262: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/sodium_compat/autoload-php7.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:17:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:17:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 15:17:23 H=([167.148.167.71]) [167.148.167.71]:51519 F=<Suport@oxbold.com> rejected RCPT <sales@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:18:06 dovecot_login authenticator failed for H=(wiNSv12Xa) [158.94.208.175]:51768: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:18:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59202: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:18:38 dovecot_login authenticator failed for H=(6kmzmiG) [165.154.254.163]:58039: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/sodium_compat/lib/php84compat_const.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:18:07 dovecot_login authenticator failed for H=(qAQP23) [165.154.235.122]:54056: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:18:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:18:19 dovecot_login authenticator failed for H=(oDHza2gMZ0) [165.154.254.163]:54314: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:18:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38706: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/sodium_compat/src/Core/AEGIS/State256.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:19:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:19:17 dovecot_login authenticator failed for H=(lLOgvz) [165.154.254.163]:65525: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 15:19:36 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:52109: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 148.113.166.33
country_id: 6251999
domain: kendek.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 15:20:01 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:19:05 dovecot_login authenticator failed for H=(rxPn7yJcf) [165.154.235.122]:60612: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:19:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54751: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:19:25 dovecot_login authenticator failed for H=(O6lmEKv) [178.16.54.138]:52241: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:19:42 dovecot_login authenticator failed for H=(HMIJOrm2) [158.94.208.175]:50227: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.30.43.42
country_id: 1835841
description:
2026-02-02 15:19:52 dovecot_login authenticator failed for H=([210.117.217.236]) [202.30.43.42]:48756: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.129.201
country_id: 1835841
description:
2026-02-02 15:20:33 dovecot_login authenticator failed for H=([168.126.129.201]) [168.126.129.201]:55108: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/sodium_compat/src/Core32/Curve25519/Fe.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:20:14 dovecot_login authenticator failed for H=(yYKBqc3RaG) [165.154.254.163]:61152: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2026-02-02 15:20:11 dovecot_login authenticator failed for H=([49.124.151.56]) [49.124.151.56]:50136: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:20:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:20:14 dovecot_login authenticator failed for H=(CiNl49X34) [158.94.208.175]:62410: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-02-02 15:20:36 dovecot_login authenticator failed for H=(4c5e0c0de7c6.mldns.ru) [109.72.235.193]:37594: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:20:03 dovecot_login authenticator failed for H=(u5KvhMgCw) [165.154.235.122]:63886: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-02-02 15:20:42 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:48784: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:20:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34594: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:20:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49535: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:21:25 dovecot_login authenticator failed for H=(5dEIkeio) [165.154.235.122]:64391: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.67
country_id: 1733045
description:
2026-02-02 15:21:36 dovecot_login authenticator failed for H=([49.125.201.67]) [49.125.201.67]:47922: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.90.68
country_id: 1814991
description:
2026-02-02 15:21:47 dovecot_login authenticator failed for H=([124.152.90.68]) [124.152.90.68]:50265: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-02-02 15:21:53 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.179]:43862: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.234.135.54
country_id: 1562822
description:
2026-02-02 15:21:57 dovecot_login authenticator failed for H=(125.234.135.54.hcm.viettel.vn) [125.234.135.54]:42443: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 15:21:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:21:20 dovecot_login authenticator failed for H=(aWcyqeYD) [158.94.208.175]:58852: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:21:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:21:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60048: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:21:12 dovecot_login authenticator failed for H=(xiH3rycj) [165.154.254.163]:56953: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:22:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54964: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:22:09 dovecot_login authenticator failed for H=(yyYEJwXE) [165.154.254.163]:52405: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:22:44 dovecot_login authenticator failed for H=(zQN0gA2) [165.154.235.122]:64147: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:22:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:22:06 dovecot_login authenticator failed for H=(AVUOsV3) [165.154.235.122]:61432: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:22:21 dovecot_login authenticator failed for H=(tzBa5D) [158.94.208.175]:62018: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:23:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.22.18.10
country_id: 6252001
description:
[2026-02-02 15:23:56 +0800] info [cpaneld] 45.22.18.10 - stealthvenomcom "GET /login/?login_only=1&user=stealthvenomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealthvenomcom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:23:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64253: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:23:04 dovecot_login authenticator failed for H=(comllt) [165.154.235.122]:53798: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.142.183.197
country_id: 6252001
description:
[2026-02-02 15:24:01 +0800] info [cpaneld] 76.142.183.197 - stealthven "GET /login/?login_only=1&user=stealthven&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealthven (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:23:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43138: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:23:08 dovecot_login authenticator failed for H=(694cWNFv88) [165.154.254.163]:64697: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-02-02 15:23:57 dovecot_login authenticator failed for H=([111.26.63.86]) [111.26.63.87]:58528: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.45.112.249
country_id: 6252001
description:
[2026-02-02 15:23:58 +0800] info [cpaneld] 73.45.112.249 - stealthveno "GET /login/?login_only=1&user=stealthveno&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealthveno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 15:23:11 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.23.248.186
country_id: 6252001
description:
[2026-02-02 15:23:50 +0800] info [cpaneld] 70.23.248.186 - stealthvenom "GET /login/?login_only=1&user=stealthvenom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealthvenom (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.149.237
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Tests/Fixtures/annotated.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.24.139
country_id: 6252001
domain: 34.221.200.0
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.221.200.0/azenv.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.104.61.214
country_id: 6252001
description:
[2026-02-02 15:23:53 +0800] info [cpaneld] 208.104.61.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:23:15 dovecot_login authenticator failed for H=(Fyn8Dt) [178.16.54.138]:52087: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:24:05 dovecot_login authenticator failed for H=(7KNsu67) [165.154.254.163]:59973: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:24:18 dovecot_login authenticator failed for H=(C4Yfqw) [158.94.208.175]:51552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:24:22 dovecot_login authenticator failed for H=(GvRqSbjx) [165.154.235.122]:52424: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.186.225.71
country_id: 6252001
description:
[2026-02-02 15:24:22 +0800] info [cpaneld] 71.186.225.71 - stealth1 "GET /login/?login_only=1&user=stealth1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealth1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:24:23 dovecot_login authenticator failed for H=(ZToCtfIDgs) [178.16.54.138]:63832: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:24:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54221: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-02-02 15:24:14 dovecot_login authenticator failed for H=([211.53.58.1]) [211.169.212.206]:52075: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:24:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:24:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.68.238.74
country_id: 6252001
description:
[2026-02-02 15:24:06 +0800] info [cpaneld] 12.68.238.74 - stealthv "GET /login/?login_only=1&user=stealthv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealthv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.191.202.249
country_id: 6252001
description:
[2026-02-02 15:24:09 +0800] info [cpaneld] 24.191.202.249 - stealth "GET /login/?login_only=1&user=stealth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealth (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.230.215.128
country_id: 6252001
description:
[2026-02-02 15:24:18 +0800] info [cpaneld] 68.230.215.128 - ste "GET /login/?login_only=1&user=ste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.132.231.43
country_id: 6252001
description:
[2026-02-02 15:24:20 +0800] info [cpaneld] 71.132.231.43 - st "GET /login/?login_only=1&user=st&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user st (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-02-02 15:24:55 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (fericy) [98.193.112.85]:34696: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.29.22.153
country_id: 6252001
description:
[2026-02-02 15:24:03 +0800] info [cpaneld] 108.29.22.153 - stealthve "GET /login/?login_only=1&user=stealthve&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealthve (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.104.16.101
country_id: 6252001
description:
[2026-02-02 15:24:11 +0800] info [cpaneld] 97.104.16.101 - stealt "GET /login/?login_only=1&user=stealt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.86.115.207
country_id: 6252001
description:
[2026-02-02 15:24:13 +0800] info [cpaneld] 67.86.115.207 - steal "GET /login/?login_only=1&user=steal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user steal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.3.230
country_id: 6252001
description:
[2026-02-02 15:24:16 +0800] info [cpaneld] 172.58.3.230 - stea "GET /login/?login_only=1&user=stea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stea (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:25:03 dovecot_login authenticator failed for H=(06VD1Bi) [165.154.254.163]:55234: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/library/SimplePie/Net/IPv6.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:25:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57064: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:25:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:25:20 dovecot_login authenticator failed for H=(1LocSxw5B) [165.154.235.122]:54708: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:25:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:25:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64627: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:25:49 dovecot_login authenticator failed for H=(q0jXBBP) [158.94.208.175]:50465: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:26:19 dovecot_login authenticator failed for H=(p3lbDBN) [165.154.254.163]:52007: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:26:21 dovecot_login authenticator failed for H=(9udEUfPfWI) [158.94.208.175]:58024: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:26:17 dovecot_login authenticator failed for H=(chbX1HS) [165.154.235.122]:65197: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:26:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:26:23 dovecot_login authenticator failed for H=(mTUO3NlJH) [178.16.54.138]:55804: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:26:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60512: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:26:58 dovecot_login authenticator failed for H=(VeMSmguHxG) [165.154.254.163]:58501: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/src/HTTP/FileClient.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 6252001
description:
Feb  2 15:27:26 sv3 pure-ftpd[1942692]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:27:15 dovecot_login authenticator failed for H=(gfObEK) [165.154.235.122]:60652: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:27:32 dovecot_login authenticator failed for H=(7s6XaJNh) [178.16.54.138]:62748: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:27:17 dovecot_login authenticator failed for H=(Apr0UFWFu) [165.154.254.163]:61921: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:27:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46872: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:27:23 dovecot_login authenticator failed for H=(J0boJG) [158.94.208.175]:56839: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.188
country_id: 6252001
description:
2026-02-02 15:27:27 295553 [Warning] Aborted connection 295553 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.188' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:27:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.67
country_id: 6252001
description:
2026-02-02 15:27:28 295554 [Warning] Aborted connection 295554 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.67' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:27:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57388: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.226.234.238
country_id: 1269750
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93804.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ed2735ea504a3839d7501ce05a1daecbd75f41a||Title:0xb10406b2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:28:57 dovecot_login authenticator failed for H=(wSIoKomZ) [158.94.208.175]:51138: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:29:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24203: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:28:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:28:17 dovecot_login authenticator failed for H=(NbhXqD5TX) [165.154.254.163]:55630: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:28:14 dovecot_login authenticator failed for H=(U6bc2C8Li6) [165.154.235.122]:65388: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:28:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50805: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:28:35 dovecot_login authenticator failed for H=(IPoMSm) [178.16.54.138]:51080: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:29:13 dovecot_login authenticator failed for H=(iN5rdjoY) [165.154.235.122]:56401: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:29:21 dovecot_login authenticator failed for H=(p8LUGqe) [158.94.208.175]:49424: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:29:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40230: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:29:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62390: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:29:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:29:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24203: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:29:14 dovecot_login authenticator failed for H=(B3CFbID) [165.154.254.163]:49376: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:30:13 dovecot_login authenticator failed for H=(GqrPoTV) [165.154.235.122]:59041: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:30:34 dovecot_login authenticator failed for H=(Ge8CN1RZ) [178.16.54.138]:52601: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:48414: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:30:12 dovecot_login authenticator failed for H=(1cU2mswx) [165.154.254.163]:59188: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:30:24 dovecot_login authenticator failed for H=(3IkL1iz) [158.94.208.175]:62967: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:30:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:30:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58033: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:31:11 dovecot_login authenticator failed for H=(aTShzdu57) [165.154.235.122]:59119: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:31:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53880: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:31:38 dovecot_login authenticator failed for H=(EiJG1qe) [178.16.54.138]:49377: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:31:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:31:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52370: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:31:10 dovecot_login authenticator failed for H=(u7AuHw8) [165.154.254.163]:52652: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:31:29 dovecot_login authenticator failed for H=(HXB1MSJt) [165.154.254.163]:56147: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 15:31:32 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:48414: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:32:09 dovecot_login authenticator failed for H=(kexIyiA) [165.154.235.122]:59403: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:32:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51986: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:32:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:32:08 dovecot_login authenticator failed for H=(2tS8r8ai) [158.94.208.175]:52586: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:32:08 dovecot_login authenticator failed for H=(WxTnG0) [165.154.254.163]:63312: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:32:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:33:03 dovecot_login authenticator failed for H=(rADorDiUAO) [178.16.54.138]:53021: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:33:06 dovecot_login authenticator failed for H=(jhpCWVr) [165.154.235.122]:64057: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:33:30 dovecot_login authenticator failed for H=(98xxNZ7) [178.16.54.138]:54830: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:33:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:33:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42480: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:33:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:33:05 dovecot_login authenticator failed for H=(vSEzcI) [165.154.254.163]:57825: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:33:51 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53436: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:33:16 dovecot_login authenticator failed for H=(QwkWi73N) [158.94.208.175]:59482: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-02-02 15:34:46 dovecot_plain authenticator failed for H=(sacheecle) [154.146.238.122]:39414: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:34:22 dovecot_login authenticator failed for H=(VmlAQ1ast) [165.154.235.122]:62192: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.236.250.135
country_id: 6252001
description:
[2026-02-02 15:34:25 +0800] info [cpaneld] 76.236.250.135 - mssaorgmy "GET /login/?login_only=1&user=mssaorgmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssaorgmy (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 87.192.224.2
country_id: 1512440
domain: mckd.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13827.mckd.com.my||ServerName:mckd.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f8a148a29e3b26b19b9781c508a9f981328a2b59||Title:0x7ea43e23||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.12.227.17
country_id: 6252001
description:
[2026-02-02 15:34:43 +0800] info [cpaneld] 146.12.227.17 - mss "GET /login/?login_only=1&user=mss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.15.17.24
country_id: 6252001
description:
[2026-02-02 15:34:47 +0800] info [cpaneld] 104.15.17.24 - ms "GET /login/?login_only=1&user=ms&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ms (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:34:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:34:22 dovecot_login authenticator failed for H=(PwU4Yr) [158.94.208.175]:54687: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.72.196.158
country_id: 6252001
description:
[2026-02-02 15:34:32 +0800] info [cpaneld] 99.72.196.158 - mssaorg "GET /login/?login_only=1&user=mssaorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssaorg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:34:34 dovecot_login authenticator failed for H=(HqZKGH) [178.16.54.138]:51568: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:34:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53436: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.82.43
country_id: 6252001
description:
[2026-02-02 15:34:29 +0800] info [cpaneld] 24.12.82.43 - mssaorgm "GET /login/?login_only=1&user=mssaorgm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssaorgm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.76.228.236
country_id: 6252001
description:
[2026-02-02 15:34:40 +0800] info [cpaneld] 74.76.228.236 - mssao "GET /login/?login_only=1&user=mssao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.181.254.102
country_id: 6252001
description:
[2026-02-02 15:34:22 +0800] info [cpaneld] 70.181.254.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.215.121.168
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/markbaker/complex/classes/src/functions/abs.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.177.187.216
country_id: 6252001
description:
[2026-02-02 15:34:19 +0800] info [cpaneld] 24.177.187.216 - mssa "GET /login/?login_only=1&user=mssa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:34:21 dovecot_login authenticator failed for H=(TPTmzgQsD) [165.154.254.163]:55943: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:35:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49823: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:35:18 dovecot_login authenticator failed for H=(8AZFQMf7) [165.154.254.163]:49828: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:35:19 dovecot_login authenticator failed for H=(AGDZGRQq) [165.154.235.122]:64604: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:35:35 dovecot_login authenticator failed for H=(Qiu9ZoFKn) [178.16.54.138]:60963: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:35:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57522: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:35:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:35:38 dovecot_login authenticator failed for H=(PBk1QS48) [165.154.235.122]:53905: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:36:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63979: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:36:16 dovecot_login authenticator failed for H=(lERaTf58) [165.154.235.122]:52676: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.131.248
country_id: 1605651
description:
2026-02-02 15:36:17 dovecot_login authenticator failed for H=ppp-171-97-131-248.revip8.asianet.co.th ([127.0.0.1]) [171.97.131.248]:45766: 535 Incorrect authentication data (set_id=adilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:36:19 dovecot_login authenticator failed for H=(dpBS5kWUD) [158.94.208.175]:57020: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 15:36:21 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.135.161.148
country_id: 6252001
description:
2026-02-02 15:36:20 dovecot_plain authenticator failed for H=([100.64.100.6]) [63.135.161.148]:8118: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.153
country_id: 2661886
description:
2026-02-02 15:36:24 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.153]:42666: 535 Incorrect authentication data (set_id=adilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:36:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:36:15 dovecot_login authenticator failed for H=(4rELr7t9vv) [165.154.254.163]:61357: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-02-02 15:36:25 295999 [Warning] Aborted connection 295999 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.153.223.199
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/slow/7/705/702179 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:37:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:37:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48948: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 15:38:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58549: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:37:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59080: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:37:27 dovecot_login authenticator failed for H=(I6l6ZsiUJs) [158.94.208.175]:58642: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 15:37:59 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:61864: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:37:12 dovecot_login authenticator failed for H=(HlBquEc5) [165.154.254.163]:56275: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 15:37:56 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60293: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:37:13 dovecot_login authenticator failed for H=(S5vWBaPGB) [165.154.235.122]:62897: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 15:38:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58549: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:38:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53632: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/sodium_compat/namespaced/Core/Curve25519/Fe.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:38:09 dovecot_login authenticator failed for H=(JIWCmc5l) [165.154.254.163]:51324: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:38:12 dovecot_login authenticator failed for H=(Rlm37PkFL) [165.154.235.122]:61354: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:38:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.11.231.242
country_id: 1814991
description:
2026-02-02 15:38:18 dovecot_login authenticator failed for H=([1.15.123.146]) [175.11.231.242]:49982: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.147.10.33
country_id: 1694008
description:
2026-02-02 15:38:25 dovecot_login authenticator failed for H=([115.147.10.33]) [115.147.10.33]:43498: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:38:27 dovecot_login authenticator failed for H=(UOaCkFJ0W) [178.16.54.138]:63641: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-02-02 15:38:29 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:43250: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-02-02 15:38:37 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:56467: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:39:03 dovecot_login authenticator failed for H=(RzbkxizqA) [158.94.208.175]:65443: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/sodium_compat/src/Core/Base64/Original.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:39:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:39:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49505: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.135.161.148
country_id: 6252001
description:
2026-02-02 15:39:57 dovecot_plain authenticator failed for H=([100.64.100.6]) [63.135.161.148]:61776: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:39:08 dovecot_login authenticator failed for H=(J6IhTGxvd9) [165.154.254.163]:62607: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:39:10 dovecot_login authenticator failed for H=(xJNeVPcn) [165.154.235.122]:60547: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:40:08 dovecot_login authenticator failed for H=(4EPlQm) [165.154.235.122]:53620: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:40:26 dovecot_login authenticator failed for H=(lpPn1L) [165.154.254.163]:61311: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:40:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38610: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.135.161.148
country_id: 6252001
description:
2026-02-02 15:40:03 dovecot_login authenticator failed for H=([100.64.100.6]) [63.135.161.148]:61776: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:40:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:40:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-02 15:40:07 dovecot_login authenticator failed for H=(mail.jabezinnovations.com) [61.50.119.110]:30440: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:40:05 dovecot_login authenticator failed for H=(1wnWxv) [158.94.208.175]:53224: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:40:06 dovecot_login authenticator failed for H=(mQyiT9DP) [165.154.254.163]:57552: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:40:27 dovecot_login authenticator failed for H=(VUhqJ3qrm) [178.16.54.138]:53419: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:40:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61162: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:41:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:41:07 dovecot_login authenticator failed for H=(M53lKAcAZA) [165.154.235.122]:59492: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:41:33 dovecot_login authenticator failed for H=(O8GXhyN) [158.94.208.175]:54174: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:41:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:41:04 dovecot_login authenticator failed for H=(YjOBKZYaX2) [165.154.254.163]:52644: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:41:27 dovecot_login authenticator failed for H=(fWvdicE6) [178.16.54.138]:61343: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:41:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55094: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:42:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:42:07 dovecot_login authenticator failed for H=(9FJZ2qclMm) [165.154.254.163]:64870: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:42:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41086: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:42:26 dovecot_login authenticator failed for H=(lHkaGs7e) [178.16.54.138]:58556: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:42:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49699: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.103.10
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=598204 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:42:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:42:05 dovecot_login authenticator failed for H=(kYKrZvmWs) [165.154.235.122]:64632: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:42:08 dovecot_login authenticator failed for H=(fUXAc1fE) [158.94.208.175]:56049: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 122.8.94.178
country_id: 1814991
domain: agsaintifik.com.my
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://bit.ly/xxfgdnl||User:agsaintifik||SC:/home2/agsaintifik/public_html/wp-comments-post.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:43:16 dovecot_login authenticator failed for H=(8efyhdc) [158.94.208.175]:56205: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:43:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:43:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62078: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:43:06 dovecot_login authenticator failed for H=(iRxoVUgaz) [165.154.235.122]:52320: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-02-02 15:43:10 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET /cpsess7108157452/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 15:43:11 +0800] info [cpaneld] 185.204.54.153 - sirk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sirk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:43:08 dovecot_login authenticator failed for H=(soQjyWP) [165.154.254.163]:60733: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:44:06 dovecot_login authenticator failed for H=(IxwmwBRbc6) [165.154.254.163]:56306: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:44:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2fa88ebe3f1403c50bf8a83d09194eea390ba84||Title:0x6bf62827||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.138.58
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news-details3.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:44:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56182: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:44:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35020: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:44:24 dovecot_login authenticator failed for H=(Mc5MDH9M) [165.154.235.122]:56959: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:44:48 dovecot_login authenticator failed for H=(j8Rr1FQt) [158.94.208.175]:64427: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.218
country_id: 953987
description:
2026-02-02 15:44:48 dovecot_login authenticator failed for H=([196.25.113.220]) [196.25.113.218]:37058: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:44:59 dovecot_login authenticator failed for H=(UDOicV) [178.16.54.138]:53718: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:44:05 dovecot_login authenticator failed for H=(GtJMkBxvD) [165.154.235.122]:51144: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2026-02-02 15:44:25 dovecot_login authenticator failed for H=([220.161.52.149]) [220.161.52.149]:59345: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.235.102.149
country_id: 1269750
domain: medinova.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52519.medinova.com.my||ServerName:medinova.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3bcb79141c2af309d35f8c53bc29333c476abd02||Title:0xf1ff1d8b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:46:01 dovecot_login authenticator failed for H=(WTOqYOXk) [158.94.208.175]:49447: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-02 15:45:06 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (procines) [68.52.119.193]:36910: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:45:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 59.97.93.244
country_id: 1269750
domain: medinova.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82109.medinova.com.my||ServerName:medinova.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ece65f2602abc18e0ef37fa5e6cf1e6828dc7d2||Title:0x8b447783||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:45:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51596: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-02-02 15:45:36 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (unpar) [68.60.77.128]:47564: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:45:04 dovecot_login authenticator failed for H=(52LXoGQ) [165.154.235.122]:64778: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:45:06 dovecot_login authenticator failed for H=(B3G5SGVCU) [165.154.254.163]:50691: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:45:59 dovecot_login authenticator failed for H=(2xqBI5c) [178.16.54.138]:60956: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:46:36 dovecot_login authenticator failed for H=(rDQX7Fkd) [158.94.208.175]:53223: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:46:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63591: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:46:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:46:02 dovecot_login authenticator failed for H=(zrFHd1) [165.154.235.122]:50301: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:46:03 dovecot_login authenticator failed for H=(AaLYmYotc) [165.154.254.163]:62324: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.167.225
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=203673 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:46:54 dovecot_login authenticator failed for H=(wzah34Vki) [178.16.54.138]:52035: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:46:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39702: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.210.25
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/listing-details.php?id=27547921 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f3ba09ca3abe40b2f2711944750573f42edaa537||Title:0x2c23830a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:47:04 dovecot_login authenticator failed for H=(i1tXeOaOYF) [165.154.254.163]:57601: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:47:10 dovecot_login authenticator failed for H=(LvKD7czq3) [158.94.208.175]:51719: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.36.15.112
country_id: 1269750
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/taste-trade.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:47:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:47:21 dovecot_login authenticator failed for H=(FJoLqHVg) [165.154.235.122]:61103: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a4052ae62a49cee8d4e4c8063d3c45cd8b8b75a||Title:0x37899742||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:47:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57913: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:48:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50908: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:48:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:48:21 dovecot_login authenticator failed for H=(zngk1SeUrH) [165.154.254.163]:61024: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:48:38 dovecot_login authenticator failed for H=(afpJn7bq) [165.154.254.163]:49892: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-02-02 15:48:54 +0800] info [webmaild] 175.142.119.17 - admin@pftfood.com "GET /cpsess0297360586/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:48:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52581: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:48:18 dovecot_login authenticator failed for H=(bCxuiFE) [165.154.235.122]:53510: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:48:15 dovecot_login authenticator failed for H=(vHFl5iDN) [158.94.208.175]:53123: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:48:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:48:19 dovecot_login authenticator failed for H=(iCQuzGkACZ) [178.16.54.138]:50734: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 15:48:54 dovecot_login authenticator failed for H=(d0XAW1bD3i) [69.5.189.21]:60839: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 15:48:26 +0800] info [cpaneld] 185.204.54.153 - asam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:49:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51411: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:49:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:49:21 dovecot_login authenticator failed for H=(bExC20g5) [165.154.235.122]:54728: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:49:20 dovecot_login authenticator failed for H=(dQfbp71YJc) [165.154.254.163]:60910: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 15:49:17 dovecot_login authenticator failed for H=(LA5L8Tgb2t) [69.5.189.21]:64878: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:49:21 dovecot_login authenticator failed for H=(ZgGtGwAcg) [178.16.54.138]:60402: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:49:25 dovecot_login authenticator failed for H=(VMal2u1yEd) [158.94.208.175]:58084: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:49:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:41b42b955e7030f5d78b3464299744879b2ad644||Title:0xc0ac7d32||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:50:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:50:21 dovecot_login authenticator failed for H=(MaG0g83pN) [165.154.235.122]:56437: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:50:21 dovecot_login authenticator failed for H=(mGiqltiD) [178.16.54.138]:54236: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:50:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36786: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 15:50:05 dovecot_login authenticator failed for H=(pgTse0n2l) [69.5.189.21]:56489: 535 Incorrect authentication data (set_id=kl.tai)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.185.14
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-more.php?id=810752 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:50:20 dovecot_login authenticator failed for H=(eglYJzz) [165.154.254.163]:62339: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:50:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62439: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:50:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:51:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58892: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:51:20 dovecot_login authenticator failed for H=(vM7OFewn) [178.16.54.138]:65053: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:51:22 dovecot_login authenticator failed for H=(VBvIAbKogN) [165.154.254.163]:58809: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:51:07 dovecot_login authenticator failed for H=(oIXAtSGS) [158.94.208.175]:54557: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:51:19 dovecot_login authenticator failed for H=(wXGNjxx65l) [165.154.235.122]:54635: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d1aad873027932acdd191d5b4c9e0554c580edb8||Title:0x516c4a0e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.85.26.226
country_id: 6252001
description:
2026-02-02 15:51:42 dovecot_login authenticator failed for H=(BO1slgmDBK) [66.85.26.226]:62997: 535 Incorrect authentication data (set_id=din)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 15:51:14 dovecot_login authenticator failed for H=(VIwpLh) [69.5.189.21]:51121: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:51:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.121.146
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/open-barista.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:52:09 dovecot_login authenticator failed for H=(QkHXKH) [165.154.254.163]:50598: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:52:11 dovecot_login authenticator failed for H=(856cIBouyY) [158.94.208.175]:52367: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:52:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53142: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:52:20 dovecot_login authenticator failed for H=(C1SKKh6hf) [178.16.54.138]:60110: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-02-02 15:52:46 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:53702: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
country_id: 1835841
description:
2026-02-02 15:52:56 dovecot_login authenticator failed for H=([175.198.18.3]) [175.198.18.3]:61102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:52:58 dovecot_login authenticator failed for H=(cn293tb) [165.154.235.122]:53053: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 15:52:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:52:20 dovecot_login authenticator failed for H=(DX3wzEtTGo) [165.154.235.122]:49901: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 15:52:48 dovecot_login authenticator failed for H=(wtUIIhGt) [69.5.189.21]:50478: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:53:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64666: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-02 15:53:15 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:52784: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.203.223
country_id: 298795
description:
2026-02-02 15:53:03 dovecot_login authenticator failed for H=([176.30.203.223]) [176.30.203.223]:57748: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:53:09 dovecot_login authenticator failed for H=(1HJf04) [165.154.254.163]:61151: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:53:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37422: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-02-02 15:53:11 +0800] info [webmaild] 180.75.72.60 - regalacc@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 15:53:12 dovecot_login authenticator failed for H=(JZeKAU9g) [69.5.189.21]:63444: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:53:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:53:18 dovecot_login authenticator failed for H=(3cvh59mFjA) [165.154.235.122]:64987: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:53:19 dovecot_login authenticator failed for H=(E15cnh) [158.94.208.175]:53338: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.211.246.121
country_id: 1814991
description:
2026-02-02 15:53:22 dovecot_login authenticator failed for H=([221.211.246.121]) [221.211.246.121]:42023: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.32
country_id: 1733045
description:
2026-02-02 15:53:29 dovecot_login authenticator failed for H=([49.124.153.32]) [49.124.153.32]:49218: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e257e2b62a00126e4a20d4d9df75a257fdbad2ee||Title:0x6997049d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-02-02 15:53:42 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [203.196.42.114]:56484: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.50.54
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=63011516690410 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 15:54:07 dovecot_login authenticator failed for H=(Z1aq3F) [165.154.254.163]:55320: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:54:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:54:16 dovecot_login authenticator failed for H=(ym0kOj8rL) [165.154.235.122]:59987: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3dd6ef85fa9e32dc7e9fee6d10d37657600a6248||Title:0x54e0698f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:54:21 dovecot_login authenticator failed for H=(TGzSDD9b) [158.94.208.175]:64366: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:54:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51024: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-02 15:54:45 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (repintions) [74.218.95.154]:57281: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:54:16 dovecot_login authenticator failed for H=(hqcUygiHqx) [178.16.54.138]:52948: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-02-02 15:54:17 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (dentisseed) [50.74.136.134]:37288: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:55:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48842: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:55:20 dovecot_login authenticator failed for H=(aIenIUR) [165.154.235.122]:53259: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:55:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61490: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:55:14 dovecot_login authenticator failed for H=(tnblwqOL) [178.16.54.138]:53280: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:55:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:55:23 dovecot_login authenticator failed for H=(M8VTpJ) [158.94.208.175]:59048: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:56:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:56:16 dovecot_login authenticator failed for H=(rCtuZZcb) [178.16.54.138]:51476: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:56:27 dovecot_login authenticator failed for H=(mfdvs6plN) [158.94.208.175]:53044: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c8b9b01d704575855316079120ba067952fc425||Title:0x760180ac||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24206: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:56:17 dovecot_login authenticator failed for H=(E4JOHifh) [165.154.235.122]:63235: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:56:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56313: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 15:56:03 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50438: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:57:33 dovecot_login authenticator failed for H=(jENH7dbn) [165.154.235.122]:57294: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:57:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24206: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:57:19 dovecot_login authenticator failed for H=(fzKhEjkRM) [178.16.54.138]:60866: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:57:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59630: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:58:01 dovecot_login authenticator failed for H=(jf4AnlI) [158.94.208.175]:61417: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:57:14 dovecot_login authenticator failed for H=(frmztVAPB) [165.154.235.122]:54278: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:57:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50274: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:57:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.48.24.108
country_id: 1733045
description:
[2026-02-02 15:57:54 +0800] info [webmaild] 60.48.24.108 - eesabah@evergrown.com.my "POST /cpsess6539839538/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.143.117.50] != Current IP Address [60.48.24.108]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:58:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61551: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:58:12 dovecot_login authenticator failed for H=(g7NXyRKO) [165.154.235.122]:63763: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c89e69789d511908becef244baf6f8bb249610c0||Title:0xf202005f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 15:58:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 15:58:15 dovecot_login authenticator failed for H=(uTDxzpWhJ) [178.16.54.138]:50871: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:58:33 dovecot_login authenticator failed for H=(13JK9Avn) [158.94.208.175]:56416: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:59:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:49010: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-02-02 15:59:38 dovecot_plain authenticator failed for H=(capst) [91.73.188.251]:52167: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:950c796b928f5e1c1c4ae070098c5e5542b4d5b7||Title:0x1bed829d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 15:59:10 dovecot_login authenticator failed for H=(ySXffE1U5F) [165.154.235.122]:55427: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 15:59:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55150: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 15:59:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54436: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 15:59:04 dovecot_login authenticator failed for H=(ANLxVR) [158.94.208.175]:51735: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 15:59:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:49010: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:00:07 dovecot_login authenticator failed for H=(TaiSDD2N) [165.154.235.122]:53022: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:00:08 dovecot_login authenticator failed for H=(Gs4HDW) [178.16.54.138]:62795: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:00:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59502: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2026-02-02 16:00:25 dovecot_login authenticator failed for H=95-87-213-16.ip.btc-net.bg [95.87.213.16]:40696: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:00:16 dovecot_login authenticator failed for H=(u9cbIbURY) [158.94.208.175]:51466: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 16:00:57 297475 [Warning] Aborted connection 297475 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-02-02 16:00:06 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:33964: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:01:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.22
country_id: 1269750
description:
2026-02-02 16:01:21 dovecot_login authenticator failed for H=([127.0.0.1]) [27.123.98.22]:54800: 535 Incorrect authentication data (set_id=admin@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:01:18 dovecot_login authenticator failed for H=(ufEQKyRgv) [158.94.208.175]:59302: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 16:01:21 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:53345: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:01:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63151: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:01:04 dovecot_login authenticator failed for H=(n0vq0YY) [165.154.235.122]:64908: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:547646419600038e0ed8ceb929656810ad149559||Title:0x3e7689cf||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 113.44.127.6
country_id: 1814991
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/centre-seal-bag/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:01:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56170: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:02:01 dovecot_login authenticator failed for H=(Yv1clRy7yI) [165.154.235.122]:52741: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/images/home/video.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:02:20 dovecot_login authenticator failed for H=(hGdDOG) [165.154.235.122]:60933: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:02:25 dovecot_login authenticator failed for H=(tnZvRSTvmE) [158.94.208.175]:61853: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:02:26 dovecot_login authenticator failed for H=(UOIqm6) [178.16.54.138]:59589: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:02:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57546: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:02:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.8
country_id: 1733045
description:
2026-02-02 16:03:18 dovecot_login authenticator failed for H=([49.124.151.8]) [49.124.151.8]:43718: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2026-02-02 16:03:29 dovecot_login authenticator failed for H=([49.124.153.15]) [49.124.153.15]:41380: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:03:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34270: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:03:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58261: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:03:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:03:17 dovecot_login authenticator failed for H=(CARTs3s) [165.154.235.122]:51331: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:03:34 dovecot_login authenticator failed for H=(vfuQtg) [158.94.208.175]:63420: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-02-02 16:03:36 dovecot_plain authenticator failed for H=(cleybrics) [37.28.177.141]:25283: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:836bfb6c86271e33c1ad43ecfb8e3f3c6c42e956||Title:0x664954a3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2026-02-02 16:04:20 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:54510: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2026-02-02 16:04:32 dovecot_login authenticator failed for H=([50.217.255.171]) [50.217.255.171]:34698: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:04:14 dovecot_login authenticator failed for H=(wI9f9yHU82) [165.154.235.122]:57265: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:04:18 dovecot_login authenticator failed for H=(OipXZzX5RH) [178.16.54.138]:61273: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:04:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62996: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 203.149.194.218
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/includes/contact-form.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:04:06 dovecot_login authenticator failed for H=(xje3jTpS) [158.94.208.175]:49856: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:04:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:05:40 dovecot_login authenticator failed for H=(MXFnGp) [158.94.208.175]:57745: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 16:05:03 H=([167.148.167.71]) [167.148.167.71]:50983 F=<Suport@aoto.com.my> rejected RCPT <aoto@aoto.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:05:12 dovecot_login authenticator failed for H=(OHFMyv) [165.154.235.122]:57794: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:05:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58292: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 16:06:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50858: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:05:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c64fd2320889af33a3e827fa7004db4b775ab18||Title:0x9d1082eb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 16:06:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50858: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-02-02 16:06:17 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:36809: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-02-02 16:06:17 dovecot_login authenticator failed for H=([182.79.95.231]) [152.52.244.46]:34034: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:06:28 dovecot_login authenticator failed for H=(ih0nZnN) [165.154.235.122]:54839: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2026-02-02 16:06:03 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:46696: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:06:13 dovecot_login authenticator failed for H=(qLM5YXb) [158.94.208.175]:61513: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:06:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52481: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:06:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50928: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:06:09 dovecot_login authenticator failed for H=(raRRSnT) [165.154.235.122]:55164: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:06:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2026-02-02 16:06:41 dovecot_login authenticator failed for H=(host-94.124.225.159.gascom.net.ru) [94.124.225.159]:42198: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:07:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64686: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:73e094e57ddc204691bdd9d8b7329a6d3471b0d7||Title:0x9a6d8a5b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 16:07:04 dovecot_plain authenticator failed for H=(infia) [64.72.74.162]:33552: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:07:06 dovecot_login authenticator failed for H=(mecOxp5e) [165.154.235.122]:49803: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:08:13 dovecot_login authenticator failed for H=(IbJm4ri) [158.94.208.175]:57446: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.68.172.35
country_id: 2635167
description:
2026-02-02 16:08:51 dovecot_login authenticator failed for H=alhabsy.com [138.68.172.35]:37158: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:09:01 dovecot_login authenticator failed for H=(Mu1zQUz0p) [178.16.54.138]:63937: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:08:04 dovecot_login authenticator failed for H=(8nhtNLOLP9) [165.154.235.122]:50609: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:08:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53952: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:08:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61217: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:09:55 dovecot_login authenticator failed for H=(phFPKSUj) [178.16.54.138]:60172: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:09:03 dovecot_login authenticator failed for H=(iW9hum) [165.154.235.122]:55776: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.68.172.35
country_id: 2635167
description:
2026-02-02 16:09:07 dovecot_login authenticator failed for H=alhabsy.com [138.68.172.35]:43696: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:04fb88a2f341c419201414e1cb9b63f81248fe74||Title:0x4d66f9e2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:10:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:09:12 dovecot_login authenticator failed for H=(vC9DIwHUU) [158.94.208.175]:62124: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.47.131
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=69121514942730 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:09:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55221: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:10:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49812: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32fbcef725a72dea07d1d3168c71cb681740ea1f||Title:0xc60e9039||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:11:00 dovecot_login authenticator failed for H=(VRzNpqjI4) [165.154.235.122]:56691: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:10:02 dovecot_login authenticator failed for H=(ALJ7Nh2) [165.154.235.122]:53880: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:10:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53776: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:11:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61309: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:11:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:11:19 dovecot_login authenticator failed for H=(IgA5mcyF9) [165.154.235.122]:58076: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-download.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:11:29 dovecot_login authenticator failed for H=(m8kqRiuGRN) [178.16.54.138]:53051: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:11:41 dovecot_login authenticator failed for H=(dn3d3hX) [158.94.208.175]:49823: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:12:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:12:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56180: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:12:27 dovecot_login authenticator failed for H=(wo8xAIiN) [178.16.54.138]:63988: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:12:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44842: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3148dc21f559b3d765ab3c106c305ab1ee0a8ae6||Title:0xf4611e2a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:12:45 dovecot_login authenticator failed for H=(mKeXgsFfXJ) [158.94.208.175]:63335: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/woocommerce/includes/admin/views/html-notice-redirect-only-download.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:12:17 dovecot_login authenticator failed for H=(WBVeooW) [165.154.235.122]:55167: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:13:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49217: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:13:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:13:19 dovecot_login authenticator failed for H=(BbshNspYsq) [158.94.208.175]:50318: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.202.61.178
country_id: 1694008
domain: mkmetal.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:29973.mkmetal.com.my||ServerName:mkmetal.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:273390cfba595fffe1ba8c3f931bb58845cffb5d||Title:0xe9f0a10b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:13:16 dovecot_login authenticator failed for H=(Km0fs7l) [165.154.235.122]:59484: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:14:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64405: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:14:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55650: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 16:14:42 H=([167.148.167.71]) [167.148.167.71]:52076 F=<Suport@ms-chemicals.net> rejected RCPT <boolan@ms-chemicals.net>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:14:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:14:26 dovecot_login authenticator failed for H=(P05WRNm9) [165.154.252.84]:54356: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b2b861fb3044f92cbb5413a968911854a12154a||Title:0x66a23c89||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.55.145.104
country_id: 1210997
domain: modern.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.modern.com.my||ServerName:modern.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 16:14:07 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:49567: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:14:15 dovecot_login authenticator failed for H=(g7Kjmei) [165.154.235.122]:58913: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:14:26 dovecot_login authenticator failed for H=(Tvb79sz7) [158.94.208.175]:54199: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.191.254.114
country_id: 1694008
description:
2026-02-02 16:15:08 dovecot_plain authenticator failed for H=(sdj75ej9w6in70gwqfth5ne5) [180.191.254.114]:50284: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:15:13 dovecot_login authenticator failed for H=(6lewViz0Il) [165.154.235.122]:58578: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 16:15:24 H=([141.98.10.106]) [141.98.10.106]:62031 F=<mselhime@drake-scruggs.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:15:32 dovecot_login authenticator failed for H=(lNPLmaQGwH) [165.154.235.122]:56738: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:15:40 dovecot_login authenticator failed for H=(b3rXfm8Lk) [178.16.54.138]:64156: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 89.117.104.23
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/woocommerce/includes/react-admin/emails/html-admin-report-export-download.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:15:05 dovecot_login authenticator failed for H=(hXAxG9) [165.154.252.84]:57954: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:15:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57727: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.90.185.44
country_id: 2921044
description:
2026-02-02 16:15:26 H=([77.90.185.44]) [77.90.185.44]:50025 F=<office@lorescomarilen.org> rejected RCPT <myloo@euratech.com.my>: Mail to myloo@euratech.com.my has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:096b8397cff91fca05aa56900a42ee999c3a0b4d||Title:0xaeb5d02a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:16:42 dovecot_login authenticator failed for H=(YYzQuG) [178.16.54.138]:54924: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:16:03 dovecot_login authenticator failed for H=(4JDiqpq) [158.94.208.175]:64108: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:16:11 dovecot_login authenticator failed for H=(VSk6sl0l) [165.154.235.122]:59895: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:16:20 dovecot_login authenticator failed for H=(jpoLMI) [165.154.252.84]:55580: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:16:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57714: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:16:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62079: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:17:08 dovecot_login authenticator failed for H=(xEsSKmgT9) [165.154.235.122]:55573: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:17:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56407: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:17:08 dovecot_login authenticator failed for H=(UD3YAo) [158.94.208.175]:56040: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:17:16 dovecot_login authenticator failed for H=(IhpjOFxhgl) [165.154.252.84]:52537: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/career.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-02-02 16:17:48 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:35939: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.61.146
country_id: 1814991
description:
2026-02-02 16:17:58 dovecot_login authenticator failed for H=([120.198.61.146]) [120.198.61.146]:34918: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b06e95d18692f0a9689a8178ab45425657ce68c3||Title:0x5b395e7c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:17:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-02-02 16:17:58 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:52558: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:17:39 dovecot_login authenticator failed for H=(CDiJH4) [178.16.54.138]:55514: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2026-02-02 16:18:08 dovecot_login authenticator failed for H=([218.146.255.221]) [218.146.255.221]:60982: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:18:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:18:13 dovecot_login authenticator failed for H=(aWmlUaC) [165.154.252.84]:64182: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.49.254.229
country_id: 1269750
domain: mokshana.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:64125.mokshana.com.my||ServerName:mokshana.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a19441a307c2b1213c76695c2a5ece406b81f24d||Title:0xc02329fd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:18:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:18:07 dovecot_login authenticator failed for H=(n2r73eeYa) [165.154.235.122]:56934: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:18:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51881: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:18:41 dovecot_login authenticator failed for H=(YvmNEG2) [178.16.54.138]:58838: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:18:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36502: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:19:14 dovecot_login authenticator failed for H=(j3CVy2QhR) [158.94.208.175]:55120: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:19:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62514: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 16:19:48 H=([167.148.167.71]) [167.148.167.71]:57612 F=<Suport@ahfengineering.com> rejected RCPT <cky@ahfengineering.com>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:19:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:19:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:19:10 dovecot_login authenticator failed for H=(accWFuJR) [165.154.252.84]:53457: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22438755bbb19049bd775fd74d8903fe7c6714ec||Title:0x7e5f31c1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:19:47 dovecot_login authenticator failed for H=(NSFKK0jgjK) [165.154.252.84]:49228: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:19:34 dovecot_login authenticator failed for H=(iXMG6jfpw) [178.16.54.138]:64901: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:19:05 dovecot_login authenticator failed for H=(yFvMmlkG) [165.154.235.122]:63835: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:20:03 dovecot_login authenticator failed for H=(Z9HSZHTRAj) [165.154.235.122]:51507: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/10anniversary.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:20:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:20:05 dovecot_login authenticator failed for H=(b4PI9K) [165.154.252.84]:53355: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:20:17 dovecot_login authenticator failed for H=(pxXunB7) [158.94.208.175]:50477: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:20:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58115: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:20:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:21:30 dovecot_login authenticator failed for H=(sJa5ykGa) [178.16.54.138]:63739: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-02-02 16:21:44 dovecot_login authenticator failed for H=(dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:33994: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:21:03 dovecot_login authenticator failed for H=(gu6Kl78) [165.154.235.122]:50150: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:21:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:db71ee70de453af7a0c4a31e58d9681edf9593d1||Title:0x91cd4e6c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:21:21 dovecot_login authenticator failed for H=(Ug00pB) [165.154.252.84]:53683: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-02-02 16:21:29 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:42038: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:21:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35914: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:21:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51753: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:21:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:21:54 dovecot_login authenticator failed for H=(TwgFgfpb) [158.94.208.175]:58377: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:22:16 dovecot_login authenticator failed for H=(4z5BHP) [165.154.252.84]:54611: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:22:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:22:25 dovecot_login authenticator failed for H=(cu8hym5T) [178.16.54.138]:63671: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:22:03 dovecot_login authenticator failed for H=(HxW1uMyffb) [165.154.235.122]:54593: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:22:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62773: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:23:21 dovecot_login authenticator failed for H=(nqop4m6Vu) [165.154.235.122]:52210: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:23:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50015: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.36.152.14
country_id: 1814991
description:
2026-02-02 16:23:17 dovecot_login authenticator failed for H=([111.36.152.14]) [111.36.152.14]:53615: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.20.213.156
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/league/mime-type-detection/src/ExtensionMimeTypeDetector.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:23:05 dovecot_login authenticator failed for H=(P1EiaWgVjg) [158.94.208.175]:55796: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-02-02 16:23:06 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:51620: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e87625c252c49f06a86b1ebdd9c1abe65fb6bad8||Title:0x2402366d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:23:13 dovecot_login authenticator failed for H=(DMFjUJQ) [165.154.252.84]:64577: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:23:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40024: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 16:24:23 H=([167.148.167.71]) [167.148.167.71]:53993 F=<Suport@ajplantations.com.my> rejected RCPT <corporate_ch@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:24:10 dovecot_login authenticator failed for H=(eyNliue) [165.154.252.84]:60796: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:24:20 dovecot_login authenticator failed for H=(CuoH6D) [165.154.235.122]:64585: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:24:41 dovecot_login authenticator failed for H=(gBWQvU9ls) [158.94.208.175]:61719: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-02-02 16:24:45 +0800] info [cpaneld] 165.22.212.32 - urban "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3f262076f3de00d26709235938e767038f983594||Title:0xd8389885||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:24:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60568: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:24:29 dovecot_login authenticator failed for H=(hNJtyTkPW) [165.154.252.84]:65423: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:25:07 dovecot_login authenticator failed for H=(vTJhB2R1H) [165.154.252.84]:55184: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:25:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55978: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.68.9.78
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:application/database HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:25:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35160: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:25:13 dovecot_login authenticator failed for H=(k9fMEih1W) [158.94.208.175]:57184: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:25:19 dovecot_login authenticator failed for H=(dQeyAqreq8) [165.154.235.122]:64003: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:25:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:26:16 dovecot_login authenticator failed for H=(8BgoLWP) [178.16.54.138]:53456: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 16:26:26 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60710: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:26:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55160: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:150246e89843b2a34eb557d22c80581efc11f4be||Title:0xba2f51fd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:26:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.130.160.209
country_id: 1522867
description:
2026-02-02 16:26:08 dovecot_plain authenticator failed for H=(ulklw6pkrp0mcgzi4e1mnkbgqpc) [188.130.160.209]:48234: 535 Incorrect authentication data (set_id=nakashima@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:26:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:26:17 dovecot_login authenticator failed for H=(0M4GVi) [165.154.235.122]:55802: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:26:20 dovecot_login authenticator failed for H=(XME42k) [158.94.208.175]:50865: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:26:04 dovecot_login authenticator failed for H=(UkT0uls) [165.154.252.84]:52655: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 171.4.223.175
country_id: 1605651
description:
Feb  2 16:26:28 sv3 pure-ftpd[1998443]: (?@171.4.223.175) [WARNING] Authentication failed for user [httpclassdojo.comsham@dsc-expat.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:27:18 dovecot_login authenticator failed for H=(jZZeINg) [165.154.252.84]:58305: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:27:25 dovecot_login authenticator failed for H=(zQ2Wtqj) [158.94.208.175]:50020: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:27:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44648: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-02 16:27:07 dovecot_plain authenticator failed for H=(manation) [24.187.213.29]:46044: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:27:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:27:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52193: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:27:15 dovecot_login authenticator failed for H=(rjJ2Bu7) [165.154.235.122]:58172: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:27:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:27:19 dovecot_login authenticator failed for H=(1evf03FI) [178.16.54.138]:59261: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:28:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:28:15 dovecot_login authenticator failed for H=(rSx72Y5e) [165.154.252.84]:50067: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:28:19 dovecot_login authenticator failed for H=(GjePDBb0) [178.16.54.138]:51843: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-02-02 16:28:50 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:54801: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78453d9268d734580571dc14d03d689357914172||Title:0x617a33d9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:28:33 dovecot_login authenticator failed for H=(sFifeT) [158.94.208.175]:64249: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2026-02-02 16:28:41 dovecot_login authenticator failed for H=([49.124.152.234]) [49.124.152.234]:39316: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-02-02 16:28:58 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:60112: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:28:15 dovecot_login authenticator failed for H=(peVhi01cLj) [165.154.235.122]:56134: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:28:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53957: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:28:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:28:33 dovecot_login authenticator failed for H=(N0k7Gl) [165.154.252.84]:54404: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-02-02 16:28:39 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:53570: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:29:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:29:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51525: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:29:05 dovecot_login authenticator failed for H=(SJ5rnm) [158.94.208.175]:49672: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:29:11 dovecot_login authenticator failed for H=(dV9uASW) [165.154.252.84]:64313: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:29:13 dovecot_login authenticator failed for H=(LnXadAlu) [165.154.235.122]:51453: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:29:16 dovecot_login authenticator failed for H=(JcLiwRLbbz) [178.16.54.138]:53200: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:29:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41398: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:29:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:30:04 dovecot_login authenticator failed for H=(imQi0fUx) [158.94.208.175]:61357: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-02-02 16:30:37 dovecot_plain authenticator failed for H=(guipah) [80.227.147.94]:51187: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:30:07 dovecot_login authenticator failed for H=(Hn1VnneOR) [165.154.252.84]:60432: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:30:13 dovecot_login authenticator failed for H=(sQwy5wpBG2) [178.16.54.138]:57269: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:30:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63078: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a14f16ad5569595bbdaee5518009dcb79320e29||Title:0x00753e05||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:30:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:30:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:30:13 dovecot_login authenticator failed for H=(OJ2Gr56CK) [165.154.235.122]:56073: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 16:31:55 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:64913: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:31:11 dovecot_login authenticator failed for H=(D2mQyi) [165.154.235.122]:61947: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:31:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56845: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:31:04 dovecot_login authenticator failed for H=(b8Z3nS0Ta) [165.154.252.84]:57616: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:31:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37890: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:31:10 dovecot_login authenticator failed for H=(hWXLxZX7PK) [178.16.54.138]:53084: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa5628cbde92ddc28cf26177b95054f426dcd08f||Title:0xf3a184cf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-02-02 16:31:56 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:59900: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.214.84.37
country_id: 690791
description:
2026-02-02 16:32:04 dovecot_login authenticator failed for H=(91.214.84.37.sky-net.com.ua) [91.214.84.37]:51260: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:32:08 dovecot_login authenticator failed for H=(WOFhR1G1) [165.154.235.122]:58682: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77142120
name: IM360 WAF: Unauthenticated Arbitrary File Upload in the WordPress Plugin Simple File List < 4.2.3
abuser: 103.186.168.195
country_id: 1643084
domain: maalloys.com.my
description:
IM360 WAF: Unauthenticated Arbitrary File Upload in the WordPress Plugin Simple File List < 4.2.3||WPU:||RSV:7.71||T:APACHE||MVN:ARGS:eeSFL_FileUploadDir||MV:/wp-content/uploads/simple-file-list/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:32:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51336: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.186.168.195
country_id: 1643084
domain: maalloys.com.my
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:143090||Sizes:30||Combined size:30||User:maalloyscom||WPU:||Filename:bc711f0i.png||Scanned:/tmp//20260202-163239-aYBhJ3r3VfvQEqoeyB1vSQAAABc-file-6K5Eda||SC:/home2/maalloyscom/public_html/wp-content||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:32:46 dovecot_login authenticator failed for H=(pT8WtDsdf) [165.154.235.122]:50957: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:32:19 dovecot_login authenticator failed for H=(UFMjwBcf) [165.154.252.84]:58895: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:33:02 dovecot_login authenticator failed for H=(eM05gE) [178.16.54.138]:50820: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:33:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61451: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:33:06 dovecot_login authenticator failed for H=(ySwjzXyTCP) [165.154.235.122]:56495: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:33:16 dovecot_login authenticator failed for H=(07zMf0SFCJ) [165.154.252.84]:56535: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.227.71.6
country_id: 6252001
description:
[2026-02-02 16:33:55 +0800] info [whostmgrd] 47.227.71.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:33:08 dovecot_login authenticator failed for H=(9P8p9Arj) [158.94.208.175]:57144: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1a890ba3d17f54dcbd9c851e67e575645303553||Title:0x42c88a63||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 16:34:02 dovecot_login authenticator failed for H=(IhIHcIU0SK) [178.16.54.138]:53301: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:34:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54703: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:34:03 dovecot_login authenticator failed for H=(cZ3OXuRDFj) [165.154.235.122]:50694: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:34:14 dovecot_login authenticator failed for H=(rNofFc01C3) [158.94.208.175]:56117: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:34:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53182: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 16:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50886: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:34:11 dovecot_login authenticator failed for H=(ov3mHk) [165.154.252.84]:51808: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2026-02-02 16:34:47 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:55258: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:34:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:35:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:35:20 dovecot_login authenticator failed for H=(KokugTRZz) [165.154.235.122]:54422: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 16:35:26 dovecot_login authenticator failed for H=(YsRdE7) [158.94.208.175]:55119: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.161.14.45
country_id: 1814991
description:
2026-02-02 16:35:02 dovecot_login authenticator failed for H=([60.161.14.23]) [60.161.14.45]:46984: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:35:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64999: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:35:08 dovecot_login authenticator failed for H=(2CR6ppHy) [165.154.252.84]:62148: 535 Incorrect authentication data (set_id=norazizah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4176cbd80cd0c8ec7f2f377d2b427d014758b95||Title:0x9384dd47||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:36:19 dovecot_login authenticator failed for H=(BTTpXYwOK) [165.154.235.122]:51514: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:36:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54594: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-02-02 16:36:06 dovecot_plain authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net (floce) [73.243.234.23]:41268: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:36:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50048: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.129.234.203
country_id: 6252001
description:
[2026-02-02 16:36:33 +0800] info [whostmgrd] 102.129.234.203 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:36:05 dovecot_login authenticator failed for H=(EQheODqgDt) [165.154.252.84]:58521: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:36:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:36:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:37:01 dovecot_login authenticator failed for H=(qbvqWyJ) [165.154.252.84]:55199: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-02-02 16:37:37 dovecot_login authenticator failed for H=([128.185.247.254]) [125.19.158.2]:33146: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:37:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49621: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fadd1ad0a9d451a488534700cb236c8a843d6ffe||Title:0xe0f2fb41||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:37:18 dovecot_login authenticator failed for H=(UCGtHSbvE) [165.154.235.122]:51243: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:37:19 dovecot_login authenticator failed for H=(m8s1Nis) [165.154.252.84]:59066: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2026-02-02 16:37:07 dovecot_login authenticator failed for H=([46.163.189.191]) [46.163.189.191]:54968: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:37:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:37:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:38:15 dovecot_login authenticator failed for H=(st35HiqwP) [165.154.252.84]:53693: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:38:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38406: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.219.115.240
country_id: 1880251
description:
[2026-02-02 16:38:02 +0800] info [cpaneld] 8.219.115.240 - cofreth "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:38:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5a30ea7ce72628bc4933673bcf908ef213b7f0a9||Title:0x3e46385d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:38:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:38:16 dovecot_login authenticator failed for H=(fStBBe) [165.154.235.122]:52654: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:38:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54828: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2026-02-02 16:39:20 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.123.19]:55096: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 16:39:43 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.193.213.140
country_id: 6252001
description:
2026-02-02 16:39:44 dovecot_login authenticator failed for H=ec2-44-193-213-140.compute-1.amazonaws.com (ADMIN) [44.193.213.140]:57644: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:39:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.167
country_id: 1733045
description:
2026-02-02 16:39:11 dovecot_login authenticator failed for H=([49.124.154.167]) [49.124.154.167]:46512: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:39:15 dovecot_login authenticator failed for H=(csr3IM) [165.154.235.122]:61661: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:39:11 dovecot_login authenticator failed for H=(qWx51OYS) [165.154.252.84]:65519: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-02-02 16:39:23 dovecot_login authenticator failed for H=([187.51.128.233]) [189.44.133.238]:38596: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.4.223.175
country_id: 1605651
description:
2026-02-02 16:39:24 dovecot_plain authenticator failed for H=(DESKTOP-JKAS4I5) [171.4.223.175]:56276: 535 Incorrect authentication data (set_id=httpclassdojo.comsham@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:39:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52529: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.4.223.175
country_id: 1605651
description:
2026-02-02 16:40:15 dovecot_plain authenticator failed for H=(DESKTOP-JKAS4I5) [171.4.223.175]:59120: 535 Incorrect authentication data (set_id=httpclassdojo.comsham@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:40:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58392: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:40:08 dovecot_login authenticator failed for H=(8BR1vYl) [165.154.252.84]:60828: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.15.17.124
country_id: 1814991
description:
2026-02-02 16:40:19 dovecot_login authenticator failed for H=([127.0.0.1]) [27.15.17.124]:44947: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:40:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64026: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.158.2
country_id: 1814991
description:
2026-02-02 16:40:27 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.158.2]:54956: 535 Incorrect authentication data (set_id=jessieteoh)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.76.44.148
country_id: 2802361
description:
2026-02-02 16:40:19 299764 [Warning] Aborted connection 299764 to db: 'unconnected' user: 'unauthenticated' host: '34.76.44.148' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:40:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:40:14 dovecot_login authenticator failed for H=(OxV5h2AGv) [165.154.235.122]:60249: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b224056b2b5695b6dabd182f4666a975323f2aa||Title:0x06ff6131||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.46.243.91
country_id: 6252001
description:
2026-02-02 16:41:41 dovecot_plain authenticator failed for H=(WIN-L37FT9GV4BT) [198.46.243.91]:54220: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:41:17 dovecot_login authenticator failed for H=(aqcS65JTJ) [165.154.235.122]:64719: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:41:24 dovecot_login authenticator failed for H=(Mra22e) [165.154.252.84]:56155: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:41:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58043: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.211.246.121
country_id: 1814991
description:
2026-02-02 16:41:24 dovecot_login authenticator failed for H=([221.211.246.121]) [221.211.246.121]:50383: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.230.197
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/printspecsolutio/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-02-02 16:41:47 dovecot_login authenticator failed for H=([220.67.138.254]) [221.145.5.14]:49736: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 16:41:49 H=([167.148.167.71]) [167.148.167.71]:56513 F=<Suport@u-net.com.my> rejected RCPT <eddy@u-net.com.my>: SPF: 167.148.167.71 is not allowed to send mail from u-net.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:41:05 dovecot_login authenticator failed for H=(jbdhUhQH) [165.154.252.84]:56297: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:42:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-02-02 16:42:25 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:40905: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 16:42:08 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:39346: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:42:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52034: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:42:21 dovecot_login authenticator failed for H=(gHMxwAlFZ) [165.154.252.84]:61560: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:42:17 dovecot_login authenticator failed for H=(xfo0OZp) [165.154.235.122]:64463: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.254.185
country_id: 1835841
description:
2026-02-02 16:42:41 dovecot_login authenticator failed for H=([121.147.254.185]) [121.147.254.185]:42410: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97fe1539b6d907d0d51f9f685a369d2a2d347397||Title:0x29ff6ca3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-02-02 16:43:59 H=([77.83.39.56]) [77.83.39.56]:64245 F=<oguzhan@orontesshipping.com> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from orontesshipping.com


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.226.234.238
country_id: 1269750
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31582c751e7b0dc7ea9123391b64b48401b182eb||Title:0x86ddbf6c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.90.101.165
country_id: 2017370
description:
2026-02-02 16:43:37 dovecot_login authenticator failed for H=([127.0.0.1]) [185.90.101.165]:60362: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.111.37.211
country_id: 6252001
description:
2026-02-02 16:43:49 dovecot_login authenticator failed for H=wsip-68-111-37-211.sb.sd.cox.net ([127.0.0.1]) [68.111.37.211]:46188: 535 Incorrect authentication data (set_id=jessieteoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:43:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64075: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:43:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:43:18 dovecot_login authenticator failed for H=(UtWFlw4O) [165.154.252.84]:55095: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:43:18 dovecot_login authenticator failed for H=(yw7Maj) [165.154.235.122]:61476: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:43:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52812: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:44:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58621: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:457582d860a02e25a4f5dd406f6b1c33e47f3ff2||Title:0x2c467099||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:44:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:44:14 dovecot_login authenticator failed for H=(9k4s98B4H1) [165.154.252.84]:54205: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:44:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:44:18 dovecot_login authenticator failed for H=(mee5ZSE) [165.154.235.122]:55934: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-02-02 16:44:40 H=([77.83.39.56]) [77.83.39.56]:65205 F=<oguzhan@orontesshipping.com> rejected RCPT <khim@ktlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from orontesshipping.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:45:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:45:11 dovecot_login authenticator failed for H=(dRQvf5NG) [165.154.252.84]:52300: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:45:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35264: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-02-02 16:45:56 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:59104: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:45:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:45:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54055: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:45:19 dovecot_login authenticator failed for H=(OXdiuF) [165.154.235.122]:60642: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2026-02-02 16:45:26 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:51682: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:45:49 dovecot_login authenticator failed for H=(sJTIcK) [165.154.252.84]:60447: 535 Incorrect authentication data (set_id=norazizah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1f695ae71ca29b5ed1fb03130b601629b7abfe3||Title:0xe598ddf0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:46:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.242.57
country_id: 1269750
domain: myfurnitureshop.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:29409.myfurnitureshop.com.my||ServerName:myfurnitureshop.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4246f9787a7d22734dec125772e0ba89e720cb5a||Title:0x87ea5c65||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:46:07 dovecot_login authenticator failed for H=(izijR3X) [165.154.252.84]:65112: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:46:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50188: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:46:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 16:46:11 H=([167.148.167.71]) [167.148.167.71]:55908 F=<Suport@tujusetia.my> rejected RCPT <engkong.wee@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:46:19 dovecot_login authenticator failed for H=(pS4AbON3K) [165.154.235.122]:54413: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:47:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58830: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9f72927f9dad39501aec0ad63d571dbcbec48af||Title:0x18169822||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:47:19 dovecot_login authenticator failed for H=(DPuobKSvE) [165.154.235.122]:63200: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:47:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:47:04 dovecot_login authenticator failed for H=(bqYZyGRzEy) [165.154.252.84]:62748: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:47:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61196: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:48:20 dovecot_login authenticator failed for H=(s9TRr33) [165.154.252.84]:64204: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:48:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49638: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-02 16:48:11 dovecot_plain authenticator failed for H=(derete) [5.32.99.14]:36796: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:48:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:48:19 dovecot_login authenticator failed for H=(UVVGHVdS) [165.154.235.122]:55559: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:49:18 dovecot_login authenticator failed for H=(ZbWNMrpw4y) [165.154.235.122]:63079: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
country_id: 1814991
description:
2026-02-02 16:49:42 dovecot_login authenticator failed for H=([59.34.17.130]) [59.34.17.130]:35027: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.8.6
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/food-hotel.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:49:17 dovecot_login authenticator failed for H=(qG4nOAUwuV) [165.154.252.84]:58789: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:49:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46590: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 16:49:09 H=([167.148.167.71]) [167.148.167.71]:59819 F=<Suport@hmz.com.my> rejected RCPT <enquiry@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-02-02 16:49:33 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:59754: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.15
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1ef654456a0ad7a9f0b801af17b9fc48a0715238||Title:0x7e96296e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-02-02 16:49:44 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:40230: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:49:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53725: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:50:14 dovecot_login authenticator failed for H=(syjFcTABEB) [165.154.252.84]:54410: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:50:17 dovecot_login authenticator failed for H=(zkztuj) [165.154.235.122]:58890: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:50:32 dovecot_login authenticator failed for H=(XT4dJ2LF) [165.154.252.84]:58627: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:50:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:50:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49749: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb83d6016fd0d71229a5a5e6dcab0a2e5d52d4c3||Title:0x307edd1c||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.218.244
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=216339 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 16:51:43 300378 [Warning] Aborted connection 300378 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-02-02 16:51:49 dovecot_login authenticator failed for H=([182.78.87.2]) [182.78.87.2]:39762: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:51:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42678: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:51:10 dovecot_login authenticator failed for H=(8rCACg7MG) [165.154.252.84]:56691: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:51:14 dovecot_login authenticator failed for H=(jIzpyg) [165.154.235.122]:54638: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:51:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61223: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2026-02-02 16:51:39 dovecot_login authenticator failed for H=p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:50032: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 16:51:07 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:53171: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:51:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 16:51:30 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59698: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:52:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:52:12 dovecot_login authenticator failed for H=(nmGMzwtBU) [165.154.235.122]:58012: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:52:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55122: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.244.14
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:10801832a7c29b1ac5d25750f833015eb8979357||Title:0xffca3180||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 16:53:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24813: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:52:06 dovecot_login authenticator failed for H=(lXeUPheoWD) [165.154.252.84]:55786: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:53:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44070: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 16:53:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24813: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-02 16:53:22 dovecot_plain authenticator failed for H=(frowness) [24.187.213.29]:38500: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:53:21 dovecot_login authenticator failed for H=(63C6vF) [165.154.252.84]:56023: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:53:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:53:10 dovecot_login authenticator failed for H=(9gtqQTd) [165.154.235.122]:63680: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:53:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50704: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:54:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 16:55:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:49644: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:54:16 dovecot_login authenticator failed for H=(iIm34VxTS) [165.154.252.84]:65211: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:54:07 dovecot_login authenticator failed for H=(vTpC6yguWR) [165.154.235.122]:56314: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77350441
name: IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 83.219.98.207
country_id: 732800
domain: agsaintifik.com.my
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:Harrah's Casino Valley Forge Pa||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:54:27 dovecot_login authenticator failed for H=(keNu130qr) [165.154.235.122]:61436: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:54:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61658: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:54:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:55:05 dovecot_login authenticator failed for H=(CZvAuys) [165.154.235.122]:49406: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:55:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:55:13 dovecot_login authenticator failed for H=(Kwcg3mjMV) [165.154.252.84]:55604: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:55:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:55:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55577: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 16:55:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:49644: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:56:03 dovecot_login authenticator failed for H=(crxvHw) [165.154.235.122]:57876: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:56:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42500: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:56:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62917: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:56:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:56:10 dovecot_login authenticator failed for H=(XsMwsYXj) [165.154.252.84]:52648: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:57:06 dovecot_login authenticator failed for H=(HFf6g6fLz) [165.154.252.84]:52501: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:57:21 dovecot_login authenticator failed for H=(htOROD) [165.154.235.122]:58662: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:57:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.112.81
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:57:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50739: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:58:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60127: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:58:03 dovecot_login authenticator failed for H=(TfU17K) [165.154.252.84]:63624: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:58:41 dovecot_login authenticator failed for H=(Leov2m) [165.154.252.84]:55237: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:58:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-02-02 16:58:06 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (houtot) [24.23.125.83]:49942: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:58:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 16:58:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41712: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:58:19 dovecot_login authenticator failed for H=(yMmqq2vt6) [165.154.235.122]:60177: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 16:59:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 16:59:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 16:59:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55274: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 16:59:16 dovecot_login authenticator failed for H=(4U0BOJ) [165.154.235.122]:62405: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 16:59:19 dovecot_login authenticator failed for H=(ERrKlYYJk) [165.154.252.84]:63972: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:00:13 dovecot_login authenticator failed for H=(XBUj49) [165.154.235.122]:50253: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:00:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44018: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.187.24.97
country_id: 2017370
description:
2026-02-02 17:00:33 dovecot_login authenticator failed for H=([46.187.24.97]) [46.187.24.97]:56772: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 17:00:26 dovecot_plain authenticator failed for H=(croatte) [64.72.74.162]:53073: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:00:15 dovecot_login authenticator failed for H=(Wk7uLe) [165.154.252.84]:51778: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.217
country_id: 1668284
description:
2026-02-02 17:00:26 dovecot_login authenticator failed for H=111-70-39-217.emome-ip.hinet.net [111.70.39.217]:56245: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:00:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50064: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:00:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-02 17:00:22 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:59057: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-02-02 17:00:34 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:35390: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:01:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:01:12 dovecot_login authenticator failed for H=(TegRqJe3) [165.154.252.84]:55780: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 17:01:32 H=([167.148.167.71]) [167.148.167.71]:57456 F=<Suport@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:01:11 dovecot_login authenticator failed for H=(PLn5KeXKX) [165.154.235.122]:57245: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:01:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60950: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 17:02:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50916: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:02:09 dovecot_login authenticator failed for H=(XolcDXg82) [165.154.252.84]:59897: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:02:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 17:02:59 +0800] info [cpaneld] 185.204.54.153 - dkcm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkcm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:02:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43654: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:02:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55893: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:02:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 17:02:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50916: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:02:10 dovecot_login authenticator failed for H=(mSXaEDyS) [165.154.235.122]:59650: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-02-02 17:02:34 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (holicoman) [24.98.45.238]:59470: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.8.251
country_id: 1819730
domain: mail.chs.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/chscommy/public_html/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:03:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:03:07 dovecot_login authenticator failed for H=(KBfa6ibNFv) [165.154.235.122]:49344: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:03:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53471: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:03:06 dovecot_login authenticator failed for H=(AsDcQLtx) [165.154.252.84]:55897: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:03:25 dovecot_login authenticator failed for H=(kG4U6io) [165.154.252.84]:61788: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/images/team.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:04:05 dovecot_login authenticator failed for H=(UVg98q8C) [165.154.235.122]:53420: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:04:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:04:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59726: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:04:02 dovecot_login authenticator failed for H=(Zqml6Le) [165.154.252.84]:55219: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:04:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62965: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:05:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56459: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.87.179
country_id: 1562822
domain: www.tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tst-ma.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.155.95
country_id: 6252001
description:
2026-02-02 17:05:58 301281 [Warning] Aborted connection 301281 to db: 'unconnected' user: 'unauthenticated' host: '199.45.155.95' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:05:03 dovecot_login authenticator failed for H=(ihEi86bE9) [165.154.235.122]:62108: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:05:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:05:17 dovecot_login authenticator failed for H=(8ci7jaaW) [165.154.252.84]:54548: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.171
country_id: 6252001
description:
2026-02-02 17:05:49 301272 [Warning] Aborted connection 301272 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.171' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:06:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:06:14 dovecot_login authenticator failed for H=(95gSLz27RW) [165.154.252.84]:51683: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:06:20 dovecot_login authenticator failed for H=(Hm1S8F) [165.154.235.122]:60246: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:06:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44002: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/pftfood/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:06:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51031: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:06:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pftfood/public_html/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:07:10 dovecot_login authenticator failed for H=(SpsjUc) [165.154.252.84]:59805: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:07:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:07:18 dovecot_login authenticator failed for H=(EK827W) [165.154.235.122]:57782: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:07:37 dovecot_login authenticator failed for H=(wPtbGS) [165.154.235.122]:65204: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:07:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:07:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57728: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 17:08:42 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:08:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52529: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:08:16 dovecot_login authenticator failed for H=(6QlRlFL4) [165.154.235.122]:52682: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:08:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:08:06 dovecot_login authenticator failed for H=(J4QktdW) [165.154.252.84]:56886: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:09:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59970: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:09:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:09:14 dovecot_login authenticator failed for H=(MknbNmyHjo) [165.154.235.122]:62075: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:09:52 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49633: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:09:03 dovecot_login authenticator failed for H=(osvsvdxy0b) [165.154.252.84]:53376: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:10:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49633: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:10:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:10:13 dovecot_login authenticator failed for H=(51VLs4op) [165.154.235.122]:60560: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:10:19 dovecot_login authenticator failed for H=(OUuveK8lyq) [165.154.252.84]:53764: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.226.83
country_id: 2017370
description:
2026-02-02 17:11:26 dovecot_login authenticator failed for H=([62.192.226.83]) [62.192.226.83]:37754: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.15.210
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=3741 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:11:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62641: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-02-02 17:11:16 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:54538: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:11:10 dovecot_login authenticator failed for H=(EJgKhA) [165.154.235.122]:54069: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:11:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41284: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-02-02 17:11:35 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:54901: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 17:11:38 H=([141.98.10.106]) [141.98.10.106]:62384 F=<mselhime@drake-scruggs.com> rejected RCPT <sales@acburn.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:11:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.103.80.92
country_id: 1210997
description:
2026-02-02 17:11:29 dovecot_login authenticator failed for H=(cacti.idsbangladesh.net.bd) [117.103.80.92]:40386: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:11:33 dovecot_login authenticator failed for H=(3pZhOtLDoC) [165.154.252.84]:51708: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.158.17.169
country_id: 2658434
description:
2026-02-02 17:11:43 dovecot_login authenticator failed for H=169.17.158.34.bc.googleusercontent.com (10.172.0.2) [34.158.17.169]:62419: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:11:15 dovecot_login authenticator failed for H=(KX37cWl13V) [165.154.252.84]:64528: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:12:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59651: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:12:08 dovecot_login authenticator failed for H=(dq3HJC4S) [165.154.235.122]:59551: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 146.70.147.121
country_id: 6252001
domain: nexuscollection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:21572.nexuscollection.com||ServerName:nexuscollection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b658e3d5363ec4193d667ca9061a1c3ae464af9||Title:0xc164e23e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:12:11 dovecot_login authenticator failed for H=(o5ITrm53g5) [165.154.252.84]:59536: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:13:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 17:13:19 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (convely) [87.103.126.54]:20639: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 17:13:48 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:57880: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:13:05 dovecot_login authenticator failed for H=(EgNV3Xs) [165.154.235.122]:58236: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:13:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57413: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:13:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49010: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:13:08 dovecot_login authenticator failed for H=(oC1SVT5Ttb) [165.154.252.84]:55213: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-02-02 17:14:32 1vmq0s-00000008Zjh-2BVV <= <> H=165.193.32.34.bc.googleusercontent.com ([10.88.0.4]) [34.32.193.165]:53682 P=esmtp S=5845 T="Authentication Error" for wmchan@nexuscollection.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:14:03 dovecot_login authenticator failed for H=(5yW89KN) [165.154.235.122]:55142: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:14:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:14:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:14:05 dovecot_login authenticator failed for H=(8KwAA32) [165.154.252.84]:50895: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:14:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53850: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-02-02 17:14:22 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (stran) [24.15.216.41]:41928: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 17:14:25 H=([141.98.10.106]) [141.98.10.106]:65276 F=<mselhime@drake-scruggs.com> rejected RCPT <sales@chs.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:15:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64976: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:15:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:15:20 dovecot_login authenticator failed for H=(JGYe5uOMD) [165.154.252.84]:50163: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:15:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:15:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36748: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 17:15:46 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:54260: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:15:58 dovecot_login authenticator failed for H=(k6rl3Lxt) [165.154.235.122]:54681: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-02-02 17:15:59 dovecot_plain authenticator failed for H=(chally) [5.32.107.6]:32902: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:15:20 dovecot_login authenticator failed for H=(zv16YXcprn) [165.154.235.122]:54906: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.193.51.205
country_id: 2077456
domain: smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/smartcable/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:16:17 dovecot_login authenticator failed for H=(9n7CLGN6d) [165.154.252.84]:62095: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:16:17 dovecot_login authenticator failed for H=(4utJ1dG8A) [165.154.235.122]:61696: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-02-02 17:16:24 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:44517: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-02-02 17:16:46 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:56953: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:16:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-02-02 17:16:46 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:49890: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:16:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59114: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:16:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 17:16:38 H=([167.148.167.71]) [167.148.167.71]:62607 F=<Suport@hmz.com.my> rejected RCPT <hr@hmz.com.my>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:17:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.103.30
country_id: 1814991
description:
2026-02-02 17:17:30 dovecot_login authenticator failed for H=([36.135.103.30]) [36.135.103.30]:51704: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:17:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64304: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:17:14 dovecot_login authenticator failed for H=(6ox5RJKfw) [165.154.252.84]:57639: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:17:14 dovecot_login authenticator failed for H=(FY3hXpNx) [165.154.235.122]:54624: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:17:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:17:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51332: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:18:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:18:10 dovecot_login authenticator failed for H=(4QcHKkEje) [165.154.252.84]:53615: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:18:11 dovecot_login authenticator failed for H=(M4x9zZvMnc) [165.154.235.122]:63975: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:18:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.5.131.196
country_id: 6252001
description:
2026-02-02 17:18:26 dovecot_login authenticator failed for H=([127.0.0.1]) [73.5.131.196]:46316: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:18:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57808: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:19:07 dovecot_login authenticator failed for H=(kD76xZsgil) [165.154.252.84]:49392: 535 Incorrect authentication data (set_id=norazizah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: mail.symphony-led.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/symphonyadmin/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:19:09 dovecot_login authenticator failed for H=(oHEeSJP) [165.154.235.122]:59117: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:19:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.46.243.91
country_id: 6252001
description:
2026-02-02 17:19:11 dovecot_plain authenticator failed for H=(WIN-L37FT9GV4BT) [198.46.243.91]:58632: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2026-02-02 17:19:42 dovecot_login authenticator failed for H=([223.210.27.53]) [223.210.27.53]:9592: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:19:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51855: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:19:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56432: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:20:08 dovecot_login authenticator failed for H=(orSFNf7hG) [165.154.235.122]:63897: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:20:04 dovecot_login authenticator failed for H=(xYBtZ8) [165.154.252.84]:53470: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:20:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61661: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:20:23 dovecot_login authenticator failed for H=(GyA8Rl3) [165.154.252.84]:60041: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2026-02-02 17:20:54 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:49454: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 17:21:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24822: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:21:05 dovecot_login authenticator failed for H=(nlsyMUEU) [165.154.235.122]:65160: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-02-02 17:21:10 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:43712: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 17:21:17 +0800] info [cpaneld] 185.204.54.153 - reve "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user reve (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 17:21:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24822: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:21:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:21:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42486: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:21:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55339: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:21:20 dovecot_login authenticator failed for H=(c7bOK6Q) [165.154.252.84]:65069: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.67.156
country_id: 6252001
description:
2026-02-02 17:22:20 dovecot_login authenticator failed for H=([127.0.0.1]) [72.239.67.156]:59254: 535 Incorrect authentication data (set_id=tumbletots)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.22.234
country_id: 2017370
description:
2026-02-02 17:22:11 dovecot_login authenticator failed for H=(broadband-37.204-22-234.ip.moscow.rt.ru) [37.204.22.234]:59944: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:22:17 dovecot_login authenticator failed for H=(KVH8G48) [165.154.252.84]:50682: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.251
country_id: 1668284
description:
2026-02-02 17:22:25 dovecot_login authenticator failed for H=111-70-23-251.emome-ip.hinet.net [111.70.23.251]:34800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-02-02 17:22:13 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:43706: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.103.29.13
country_id: 3057568
description:
2026-02-02 17:22:13 dovecot_login authenticator failed for H=bband-dyn13.95-103-29.t-com.sk ([127.0.0.1]) [95.103.29.13]:32856: 535 Incorrect authentication data (set_id=tumbletots@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:22:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:22:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:22:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49311: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-02-02 17:22:19 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:48238: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:22:03 dovecot_login authenticator failed for H=(ZfEs25) [165.154.235.122]:55189: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:23:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58130: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:23:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:23:13 dovecot_login authenticator failed for H=(B8nKi21) [165.154.252.84]:52544: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:23:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.212.91.18
country_id: 1814991
description:
2026-02-02 17:23:29 dovecot_login authenticator failed for H=(18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [222.212.91.18]:33143: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:23:19 dovecot_login authenticator failed for H=(M73Axo) [165.154.235.122]:58239: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:24:37 dovecot_login authenticator failed for H=(UtLeKuz) [165.154.235.122]:53191: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-02-02 17:24:03 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [122.169.40.221]:56902: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:24:17 dovecot_login authenticator failed for H=(LBrJsxPHO) [165.154.235.122]:63269: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:24:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35906: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.220
country_id: 1168579
description:
2026-02-02 17:24:53 dovecot_login authenticator failed for H=([127.0.0.1]) [103.148.92.220]:44605: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:24:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:24:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63990: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 27.107.226.142
country_id: 1269750
domain: nmahir.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:24513.nmahir.com||ServerName:nmahir.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec3e7d9a570acac4b9008254f4b0d5443632cbd2||Title:0xbb8476b7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:24:10 dovecot_login authenticator failed for H=(33o5g9L) [165.154.252.84]:50080: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:24:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 17:25:31 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59262: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:25:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.159.96
country_id: 1814991
description:
2026-02-02 17:25:04 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.159.96]:57576: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:25:15 dovecot_login authenticator failed for H=(QfzVMCi) [165.154.235.122]:59798: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:25:06 dovecot_login authenticator failed for H=(CxZUpmw) [165.154.252.84]:55444: 535 Incorrect authentication data (set_id=norazizah)


