# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:13:41 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:13:08 dovecot_login authenticator failed for H=(2qcsRf) [178.16.52.139]:50262: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:13:02 dovecot_login authenticator failed for H=(lt83AX) [165.154.235.118]:50890: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:13:14 dovecot_login authenticator failed for H=(MLngXoJdgb) [77.83.39.164]:50418: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:13:18 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:13:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65523: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.182.49
country_id: 6252001
description:
2026-02-03 03:13:48 dovecot_login authenticator failed for H=(localhost) [130.12.182.49]:61250: 535 Incorrect authentication data (set_id=ftp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:13:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53556: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:14:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:14:33 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:14:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:14:04 dovecot_login authenticator failed for H=(yC2AQSUf) [185.36.81.54]:50003: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:14:09 dovecot_login authenticator failed for H=(OTuHpv) [165.154.235.118]:2182: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:14:03 dovecot_login authenticator failed for H=(gx7Rk3) [77.83.39.164]:54641: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:14:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:14:28 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/cards/CMI8738-MC8.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:14:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57992: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:15:06 dovecot_login authenticator failed for H=(7RGP0gj) [165.154.235.118]:15300: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:15:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:15:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58321: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-02-03 03:16:01 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (citer) [69.142.126.37]:60186: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:15:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:15:19 dovecot_login authenticator failed for H=(qda8Bg) [185.36.81.54]:61883: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.125.139
country_id: 2921044
description:
Feb  3 03:15:07 sv3 pure-ftpd[2503566]: (?@165.232.125.139) [INFO] New connection from 165.232.125.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:15:17 dovecot_login authenticator failed for H=(ehzxGnA3) [165.154.235.118]:17836: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:15:17 dovecot_login authenticator failed for H=(JCQNc7p9) [77.83.39.164]:61619: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/ld.so.conf.d/pipewire-jack-x86_64.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:16:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:16:02 dovecot_login authenticator failed for H=(Mh2RSe6u2) [165.154.235.118]:28779: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:16:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35078: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-03 03:16:05 dovecot_plain authenticator failed for H=(unses) [12.150.243.22]:28237: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:16:27 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:16:05 dovecot_login authenticator failed for H=(VFx3wErMF) [77.83.39.164]:58110: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/etc/manforce.net/3rdagm.rcube.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:16:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50246: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:16:06 dovecot_login authenticator failed for H=(3BuDCd) [185.36.81.54]:50330: 535 Incorrect authentication data (set_id=colmarketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:16:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:17:03 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:17:18 dovecot_login authenticator failed for H=(7tBv0bqU) [77.83.39.164]:56608: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:17:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:17:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:17:43 dovecot_login authenticator failed for H=(p2fPiKvJ) [165.154.235.118]:51766: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:17:03 dovecot_login authenticator failed for H=(uyR0DBO) [185.36.81.54]:63450: 535 Incorrect authentication data (set_id=bkooi)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/etc/manforce.net/fatihah.rcube.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:17:09 dovecot_login authenticator failed for H=(07ka9gnmU) [165.154.235.118]:44145: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:17:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59102: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/mail/manforce.net/soking.wong.20250304/dovecot.mailbox.log||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-02-03 03:18:43 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:37108: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.34.226
country_id: 2017370
description:
2026-02-03 03:18:52 dovecot_login authenticator failed for H=([46.149.34.226]) [46.149.34.226]:53074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:18:18 dovecot_login authenticator failed for H=(S2FXW46) [185.36.81.54]:57593: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:18:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:18:06 dovecot_login authenticator failed for H=(ObEDvX) [77.83.39.164]:59946: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:18:15 H=(185.93.89.63) [185.93.89.63]:64917 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <brook.carlon@misyshealthcare.com>: The mail server could not deliver mail to brook.carlon@misyshealthcare.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:18:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53942: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:18:06 dovecot_login authenticator failed for H=(20utIIdv) [165.154.235.118]:56650: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:18:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59884: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:19:08 dovecot_login authenticator failed for H=(xwzdFp) [185.36.81.54]:50229: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:19:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64818: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:19:20 dovecot_login authenticator failed for H=(xvqGJLGY7) [77.83.39.164]:53657: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-03 03:19:37 +0800] info [cpaneld] 185.204.54.153 - eminent "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/manfotp3/mail/ctworld.net/ibrahim/dovecot.list.index.log||User:manfotp3||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:19:32 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:19:50 H=(185.93.89.63) [185.93.89.63]:65151 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <renadesmond@complete-development.com>: The mail server could not deliver mail to renadesmond@complete-development.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:19:02 dovecot_login authenticator failed for H=(N3fVD8y7Hg) [165.154.235.118]:4627: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:20:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55794: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/mail/pftfood.com/e-order/dovecot.mailbox.log||User:pftfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:20:09 dovecot_login authenticator failed for H=(pchuLx8iv2) [77.83.39.164]:55478: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:20:17 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77317988
name: IM360 WAF: Block access to quarantined files
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Block access to quarantined files||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/home/000~root~000/home3.ori/pftfood/quarantine_clamavconnector/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:20:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56376: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:20:10 dovecot_login authenticator failed for H=(6Jlr1RS) [165.154.235.118]:20248: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:20:19 dovecot_login authenticator failed for H=(xLBH60w8Z5) [185.36.81.54]:60552: 535 Incorrect authentication data (set_id=stevenng)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:20:21 dovecot_login authenticator failed for H=(XzRf6z) [165.154.235.118]:22898: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:21:28 dovecot_login authenticator failed for H=(BAzVyi) [77.83.39.164]:55931: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:21:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59635: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-02-03 03:22:01 dovecot_login authenticator failed for H=([218.156.93.203]) [218.156.93.203]:38282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:21:25 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/ssl/keys/9f662_a47b5_9173307214ace9055238838efc495241.key||User:manfotp3||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:21:48 H=(185.93.89.63) [185.93.89.63]:49233 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rizzioc@ssd.k12.wi.us>: The mail server could not deliver mail to rizzioc@ssd.k12.wi.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.1.56
country_id: 2017370
description:
2026-02-03 03:21:50 dovecot_login authenticator failed for H=broadband-5-228-1-56.ip.moscow.rt.ru [5.228.1.56]:60289: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:21:06 dovecot_login authenticator failed for H=(4UYIVpif6) [165.154.235.118]:33430: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.244.176.108
country_id: 1168579
domain: acburn.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11849.acburn.com.my||ServerName:acburn.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc00be963b959b6c5c0d4aefde2369f9b755be38||Title:0xd938abab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.120.66.229
country_id: 2017370
description:
2026-02-03 03:22:16 dovecot_login authenticator failed for H=([79.120.66.229]) [79.120.66.229]:44924: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.6
country_id: 1668284
description:
2026-02-03 03:22:41 dovecot_login authenticator failed for H=111-70-32-6.emome-ip.hinet.net [111.70.32.6]:58949: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.0.185
country_id: 2017370
description:
2026-02-03 03:22:12 dovecot_login authenticator failed for H=([46.44.0.185]) [46.44.0.185]:54642: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:22:13 dovecot_login authenticator failed for H=(Q0odhDY) [165.154.235.118]:49184: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:22:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50358: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:22:08 dovecot_login authenticator failed for H=(ECob5y5hQz) [185.36.81.54]:62748: 535 Incorrect authentication data (set_id=aoto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:22:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56017: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:22:58 dovecot_login authenticator failed for H=(GywU4UZT) [165.154.235.118]:59266: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:22:31 dovecot_login authenticator failed for H=(KJVzX0u8M) [178.16.52.139]:52968: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:22:45 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/mail/pftfood.com/ayuni/dovecot.list.index.log||User:pftfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:22:18 dovecot_login authenticator failed for H=(7eVk8T) [77.83.39.164]:52940: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.96.2
country_id: 1814991
description:
2026-02-03 03:22:26 dovecot_login authenticator failed for H=([219.129.96.2]) [219.129.96.2]:56444: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:23:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51139: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:23:08 dovecot_login authenticator failed for H=(r7M5zbh) [77.83.39.164]:62008: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.57.4
country_id: 1562822
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:23:32 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:23:53 dovecot_login authenticator failed for H=(yZ6iMe7b3) [185.36.81.54]:64569: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 03:23:03 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:64286: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:23:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:23:03 dovecot_login authenticator failed for H=(FRJoSF) [178.16.52.139]:63511: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:23:10 dovecot_login authenticator failed for H=(TEhU7H) [165.154.235.118]:61716: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:23:19 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.30.43.42
country_id: 1835841
description:
2026-02-03 03:23:51 dovecot_login authenticator failed for H=([210.117.217.236]) [202.30.43.42]:55724: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2026-02-03 03:24:01 dovecot_login authenticator failed for H=(static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:49093: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:24:44 dovecot_login authenticator failed for H=(LVMUpT) [178.16.52.139]:64750: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-02-03 03:24:16 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:51076: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:24:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52018: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:24:23 dovecot_login authenticator failed for H=(ezyQeo0) [77.83.39.164]:57355: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:24:30 H=(185.93.89.63) [185.93.89.63]:49767 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jeverett@hmhd.org>: The mail server could not deliver mail to jeverett@hmhd.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.141.169.99
country_id: 2750405
description:
2026-02-03 03:24:32 dovecot_login authenticator failed for H=99.169.141.34.bc.googleusercontent.com (10.164.0.2) [34.141.169.99]:51535: 535 Incorrect authentication data (set_id=rubinee.arulanantham@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:24:37 dovecot_login authenticator failed for H=(6uGgScLL) [185.36.81.54]:55591: 535 Incorrect authentication data (set_id=aoto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.185
country_id: 1814991
description:
2026-02-03 03:24:06 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.185]:51753: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.162.157.184
country_id: 6252001
description:
2026-02-03 03:24:14 dovecot_login authenticator failed for H=c-73-162-157-184.hsd1.ca.comcast.net ([127.0.0.1]) [73.162.157.184]:40025: 535 Incorrect authentication data (set_id=kumara.rao)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:24:04 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:24:06 dovecot_login authenticator failed for H=(m59xgd) [165.154.235.118]:9281: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:25:13 dovecot_login authenticator failed for H=(P9Qwiar) [165.154.235.118]:24578: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:25:19 dovecot_login authenticator failed for H=(4r3hJZ4pU1) [178.16.52.139]:64679: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:25:30 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:25:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60763: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:25:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33220: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:25:12 dovecot_login authenticator failed for H=(Dxmiz2i) [77.83.39.164]:51611: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:25:16 H=(185.93.89.63) [185.93.89.63]:49916 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jjenson@simula.com>: The mail server could not deliver mail to jjenson@simula.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:25:36 dovecot_login authenticator failed for H=(4XIcELgT) [165.154.235.118]:30090: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:26:04 dovecot_login authenticator failed for H=(t3gRwm) [77.83.39.164]:63234: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:26:46 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/es/img/photos/contact.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:26:42 dovecot_login authenticator failed for H=(k1F6hF3F) [185.36.81.54]:61424: 535 Incorrect authentication data (set_id=stevenng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:26:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53409: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:26:10 dovecot_login authenticator failed for H=(bCcIsYVt) [178.16.52.139]:62962: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:26:19 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:27:14 dovecot_login authenticator failed for H=(7xDlZ8j) [178.16.52.139]:53176: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:27:07 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:27:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52880: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:27:18 dovecot_login authenticator failed for H=(Ne5AlpVpY) [77.83.39.164]:55173: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:27:20 H=(185.93.89.63) [185.93.89.63]:50376 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <johnmathis@boydgaming.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 03:27:50 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:54608: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:27:08 dovecot_login authenticator failed for H=(M9MQ4bI) [185.36.81.54]:65183: 535 Incorrect authentication data (set_id=colmarketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:27:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51098: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:28:09 dovecot_login authenticator failed for H=(zmIHSV) [178.16.52.139]:50219: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.81.92.146
country_id: 1269750
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:72838.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:061dcc3e12f3ed71ef23ebaceccdc7f9f0694284||Title:0xe918a004||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:28:06 dovecot_login authenticator failed for H=(ZXXv0CCXn) [77.83.39.164]:55667: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:28:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60729: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-02-03 03:28:48 dovecot_login authenticator failed for H=([182.95.176.206]) [182.95.176.206]:43252: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:28:48 H=(185.93.89.63) [185.93.89.63]:50631 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <fonishi@century21champion.com>: The mail server could not deliver mail to fonishi@century21champion.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:28:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.242.107.53
country_id: 2017370
description:
2026-02-03 03:28:40 dovecot_login authenticator failed for H=([77.242.107.53]) [77.242.107.53]:54848: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 03:29:05 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59008: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.86.168.224
country_id: 1814991
description:
2026-02-03 03:29:33 dovecot_login authenticator failed for H=([222.86.168.224]) [222.86.168.224]:40030: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:29:20 dovecot_login authenticator failed for H=(4lGIWF) [77.83.39.164]:59610: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:29:34 H=(185.93.89.63) [185.93.89.63]:50727 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bsmith@bradford.wmsc.k12.ar.us>: The mail server could not deliver mail to bsmith@bradford.wmsc.k12.ar.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:29:42 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:29:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59114: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2026-02-03 03:29:18 dovecot_login authenticator failed for H=(bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:58293: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:29:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62648: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:29:10 dovecot_login authenticator failed for H=(58gjM9) [178.16.52.139]:58811: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:29:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:30:04 dovecot_login authenticator failed for H=(eyl5I0j) [178.16.52.139]:56845: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:30:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55528: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:30:30 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55528: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2026-02-03 03:30:46 dovecot_login authenticator failed for H=([1.31.80.222]) [1.31.80.222]:36764: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-02-03 03:30:19 dovecot_plain authenticator failed for H=(premiess) [199.192.123.12]:60180: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/css/main.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-02-03 03:30:56 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:49138: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:30:08 dovecot_login authenticator failed for H=(8MrzXqFy) [77.83.39.164]:63500: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.47.195.153
country_id: 1522867
description:
2026-02-03 03:30:40 dovecot_login authenticator failed for H=([127.0.0.1]) [95.47.195.153]:41875: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:30:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.140
country_id: 2661886
description:
2026-02-03 03:30:31 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.140]:35254: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:30:32 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.146.43
country_id: 3469034
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/about.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:31:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41786: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:31:05 dovecot_login authenticator failed for H=(vAxCHp4iJ) [178.16.52.139]:49610: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:31:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64124: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: shop.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/pftfood/public_html/epft/upload/wp-admin||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:31:31 H=(185.93.89.63) [185.93.89.63]:51211 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rwarster@hodgkinsonrealty.com>: The mail server could not deliver mail to rwarster@hodgkinsonrealty.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:31:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:31:20 dovecot_login authenticator failed for H=(sN1Gkv) [77.83.39.164]:64176: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:32:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58719: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:32:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:32:09 dovecot_login authenticator failed for H=(KnaXz9bTB) [178.16.52.139]:51974: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-02-03 03:32:29 dovecot_login authenticator failed for H=([101.13.4.120]) [101.13.4.120]:39716: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.145.62
country_id: 1835841
description:
2026-02-03 03:32:57 dovecot_login authenticator failed for H=([125.140.145.62]) [125.140.145.62]:42362: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-02-03 03:33:00 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:55717: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:32:09 dovecot_login authenticator failed for H=(IpsI1chGSp) [77.83.39.164]:54739: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:32:12 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-03 03:32:35 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:54006: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.127.206
country_id: 290557
description:
2026-02-03 03:32:36 dovecot_plain authenticator failed for H=(unmity) [94.202.127.206]:38287: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2026-02-03 03:32:50 dovecot_login authenticator failed for H=([1.82.135.154]) [1.82.135.154]:44169: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-02-03 03:33:22 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:35157: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:33:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57988: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:33:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55735: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.12.106.119
country_id: 1814991
description:
2026-02-03 03:33:13 dovecot_login authenticator failed for H=([60.12.106.119]) [60.12.106.119]:54712: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-02-03 03:33:14 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:44481: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:33:08 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:33:17 dovecot_login authenticator failed for H=(Qe6cw84z) [178.16.52.139]:55105: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.254.185
country_id: 1835841
description:
2026-02-03 03:34:01 dovecot_login authenticator failed for H=([121.147.254.185]) [121.147.254.185]:59078: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:33:22 dovecot_login authenticator failed for H=(Uv9IcEqm9v) [77.83.39.164]:65102: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:35:01 H=(185.93.89.63) [185.93.89.63]:51855 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <kmccarthy@wsfg.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:34:09 dovecot_login authenticator failed for H=(8pFnGpJLeQ) [178.16.52.139]:65235: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:34:10 dovecot_login authenticator failed for H=(qXegEN7sJ) [77.83.39.164]:58790: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:34:42 dovecot_login authenticator failed for H=(4ols6t) [178.16.52.139]:60132: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.250.17
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.54
country_id: 1814991
description:
2026-02-03 03:34:12 dovecot_login authenticator failed for H=([157.122.198.54]) [157.122.198.54]:33800: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-02-03 03:34:13 dovecot_plain authenticator failed for H=(fruppled) [192.159.99.193]:55948: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:34:23 H=(185.93.89.63) [185.93.89.63]:51716 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <eric@formicmedia.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:34:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58900: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:35:23 dovecot_login authenticator failed for H=(mgYOP46bOo) [77.83.39.164]:59086: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:35:57 H=(185.93.89.63) [185.93.89.63]:52068 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kjordan@danville.k12.pa.us>: The mail server could not deliver mail to kjordan@danville.k12.pa.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:35:25 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:35:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52146: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:35:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:36:00 dovecot_login authenticator failed for H=(2LQaXcr) [185.36.81.54]:56460: 535 Incorrect authentication data (set_id=mkmadmin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:35:17 dovecot_login authenticator failed for H=(mMjEo6FXcM) [178.16.52.139]:65461: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:36:11 dovecot_login authenticator failed for H=(nVuWf30Zr) [77.83.39.164]:52286: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:36:14 dovecot_login authenticator failed for H=(yTb57jQ614) [178.16.52.139]:51169: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:36:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61658: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.105.246
country_id: 1269750
domain: advisorygroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:57619.advisorygroup.com.my||ServerName:advisorygroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1503ce19a4ebd822e6f76a2a643b9ca110c9004c||Title:0x23fb3f3d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:36:24 dovecot_login authenticator failed for H=(bll9TJd2K7) [185.36.81.54]:62637: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:37:25 dovecot_login authenticator failed for H=(QxY0AXH8x) [77.83.39.164]:59865: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:37:28 dovecot_login authenticator failed for H=(uJdZ3d5eN) [185.36.81.54]:54570: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:37:29 dovecot_login authenticator failed for H=(zfRMsEN) [178.16.52.139]:50296: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:37:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55967: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:37:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:38:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:38:24 dovecot_login authenticator failed for H=(vJwSuJBM45) [185.36.81.54]:64425: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:38:59 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:38:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59272: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:38:11 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:38:12 dovecot_login authenticator failed for H=(eLHeDPIG) [178.16.52.139]:62615: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:38:14 dovecot_login authenticator failed for H=(HYxyMXB) [77.83.39.164]:49682: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:38:34 H=(185.93.89.63) [185.93.89.63]:52628 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <msandberg@cheqtel.com>: The mail server could not deliver mail to msandberg@cheqtel.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:38:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60696: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:39:48 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-02-03 03:39:54 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:45780: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:39:05 dovecot_login authenticator failed for H=(k239biWRMZ) [178.16.52.139]:51277: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:39:21 H=(185.93.89.63) [185.93.89.63]:52735 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jessica@conchorc.org>: The mail server could not deliver mail to jessica@conchorc.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:39:24 dovecot_login authenticator failed for H=(CVj8wGjy) [185.36.81.54]:59031: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:39:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:39:24 dovecot_login authenticator failed for H=(fGCaG5KRR) [77.83.39.164]:55009: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.173.142.7
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=571193 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:39:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51969: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2026-02-03 03:39:45 dovecot_login authenticator failed for H=([1.235.192.130]) [1.235.192.130]:59990: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:40:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:40:07 dovecot_login authenticator failed for H=(HcKFerrGX) [185.36.81.54]:49825: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:40:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49276: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:40:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54831: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:40:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.141.169.99
country_id: 2750405
description:
2026-02-03 03:40:11 dovecot_login authenticator failed for H=99.169.141.34.bc.googleusercontent.com (10.164.0.2) [34.141.169.99]:65163: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:40:15 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:40:48 dovecot_login authenticator failed for H=(SDYopf0R) [178.16.52.139]:55146: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:40:07 H=(185.93.89.63) [185.93.89.63]:52917 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mlobermeier@fs.fed.us>: The mail server could not deliver mail to mlobermeier@fs.fed.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:40:13 dovecot_login authenticator failed for H=(Ad4Vst) [77.83.39.164]:62021: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:40:18 dovecot_login authenticator failed for H=(uNc184gpH) [178.16.52.139]:60631: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:41:25 dovecot_login authenticator failed for H=(nbsNVhhZ) [77.83.39.164]:50020: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:41:40 H=(185.93.89.63) [185.93.89.63]:53307 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ngrant@grantcross.com>: The mail server could not deliver mail to ngrant@grantcross.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:41:04 dovecot_login authenticator failed for H=(25gI95p29X) [178.16.52.139]:49966: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:41:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.199.216.242
country_id: 2017370
description:
2026-02-03 03:41:34 dovecot_login authenticator failed for H=(static-217-199-216-242.tel.ru) [217.199.216.242]:58800: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:41:11 dovecot_login authenticator failed for H=(wbxnl0kbp) [185.36.81.54]:63448: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:41:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:41:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63581: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.78.247
country_id: 2017370
description:
2026-02-03 03:41:46 dovecot_login authenticator failed for H=89-179-78-247.broadband.corbina.ru [89.179.78.247]:55418: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:42:18 dovecot_login authenticator failed for H=(A4L8IOpxW) [185.36.81.54]:56089: 535 Incorrect authentication data (set_id=aoto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:42:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46514: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:42:08 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:42:16 dovecot_login authenticator failed for H=(GTpIcf3cyr) [178.16.52.139]:54907: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-02-03 03:42:44 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:57344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-02-03 03:42:20 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:49323: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:42:24 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:42:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:42:13 dovecot_login authenticator failed for H=(TGb057M5CZ) [77.83.39.164]:57780: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:42:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57093: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:43:14 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and extractvalue(1234,concat(0x7e,(select/**/repeat('3',150)),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(1234,CONCAT(0x7e,(SELECT/**/COUNT(schema_name)/**/FROM/**/INFORMATION_SCHEMA.SCHEMATA),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/sysusers.d/basic.conf||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.135.75
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(1234,CONCAT(0x7e,(SELECT/**/REPEAT('3',150)),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:43:17 dovecot_login authenticator failed for H=(QIyxUpCbKu) [185.36.81.54]:62535: 535 Incorrect authentication data (set_id=aoto)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND EXTRACTVALUE(1234,CONCAT(0x7e,(SELECT/**/COUNT(schema_name)/**/FROM/**/INFORMATION_SCHEMA.SCHEMATA),0x7e))-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/thinkcloudadmin/public_html/resources-details.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:43:02 dovecot_login authenticator failed for H=(Xh3Sfe) [178.16.52.139]:62002: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:43:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53455: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:43:25 dovecot_login authenticator failed for H=(rVQrIy) [77.83.39.164]:49313: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:43:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:44:18 dovecot_login authenticator failed for H=(NpN9SknI2) [185.36.81.54]:62057: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and extractvalue(1234,concat(0x7e,(select/**/distinct/**/table_name/**/from/**/information_schema.columns/**/where/**/table_schema='thinkcloudadmin_db'/**/and/**/column_name/**/like/**/'%password%'),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:44:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62434: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:44:14 dovecot_login authenticator failed for H=(TeXMWK) [77.83.39.164]:51457: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:44:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 185.36.81.54


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(1234,CONCAT(0x7e,(SELECT/**/DISTINCT/**/table_name/**/FROM/**/INFORMATION_SCHEMA.COLUMNS/**/WHERE/**/table_schema='thinkcloudadmin_db'/**/AND/**/column_name/**/LIKE/**/'%password%'),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:44:23 dovecot_login authenticator failed for H=(FeWhBLmaUS) [178.16.52.139]:52189: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:44:55 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:44:55 dovecot_login authenticator failed for H=(etkmNk1) [178.16.52.139]:57265: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and extractvalue(1234,concat(0x7e,(select/**/distinct/**/table_name/**/from/**/information_schema.columns/**/where/**/table_schema='thinkcloudadmin_db'/**/and/**/column_name/**/like/**/'%password%'),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 149.50.97.219
country_id: 798544
domain: thinkcloud.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(1234,CONCAT(0x7e,(SELECT/**/DISTINCT/**/table_name/**/FROM/**/INFORMATION_SCHEMA.COLUMNS/**/WHERE/**/table_schema='thinkcloudadmin_db'/**/AND/**/column_name/**/LIKE/**/'%password%'),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:44:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60264: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:45:26 dovecot_login authenticator failed for H=(yU7srbas) [77.83.39.164]:58637: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.145.49.47
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78783.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e6d601d8d982d1fd10556d92915f2a6cd03a342||Title:0x323677a5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.127.166
country_id: 1269750
description:
2026-02-03 03:45:36 dovecot_login authenticator failed for H=(abts-mp-static-166.127.168.122.airtelbroadband.in) [122.168.127.166]:57275: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 138.199.54.55
country_id: 3175395
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45074.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:61e2a9ca9e5ceac66a622637f1cfbb9d037449d8||Title:0xc9b7a60b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:45:40 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:45:25 dovecot_login authenticator failed for H=(XXY4yHkDN) [185.36.81.54]:55161: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/etc/libssh/libssh_client.config||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:45:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57583: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:45:22 dovecot_login authenticator failed for H=(ZKcR4PMEP1) [178.16.52.139]:63105: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.140.141
country_id: 290557
description:
2026-02-03 03:45:58 dovecot_plain authenticator failed for H=(tinguele) [181.214.140.141]:59090: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:46:29 H=(185.93.89.63) [185.93.89.63]:54249 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <meng@mengche.com>: The mail server could not deliver mail to meng@mengche.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:46:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53756: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.4.22
country_id: 2017370
description:
2026-02-03 03:47:01 dovecot_login authenticator failed for H=([31.173.4.22]) [31.173.4.22]:35670: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.184.1.9
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26188.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58476a93d43fdaab3c47e0ef18f01f1d088aba1b||Title:0xed6907e1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.133.42.158
country_id: 1814991
description:
2026-02-03 03:46:15 dovecot_login authenticator failed for H=([222.133.42.158]) [222.133.42.158]:33570: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:46:21 dovecot_login authenticator failed for H=(E5bIwP) [178.16.52.139]:63861: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:46:25 dovecot_login authenticator failed for H=(c5QaIsWDt) [185.36.81.54]:51675: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:46:14 dovecot_login authenticator failed for H=(QSqyVpWG) [77.83.39.164]:63966: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-03 03:46:50 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:40331: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:46:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51868: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/tmpfiles.d/apache2.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:46:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:47:07 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:47:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56784: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:47:04 dovecot_login authenticator failed for H=(0ktXC3) [178.16.52.139]:57950: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.161.168
country_id: 1562822
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=352313 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-02-03 03:47:33 dovecot_login authenticator failed for H=([182.95.20.55]) [182.95.228.106]:45526: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:47:05 dovecot_login authenticator failed for H=(pPoCtnn) [185.36.81.54]:56893: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:47:54 H=(185.93.89.63) [185.93.89.63]:54563 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rtieman@kellyfi.com>: The mail server could not deliver mail to rtieman@kellyfi.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/sysusers.d/samba.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-02-03 03:47:42 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:44254: 535 Incorrect authentication data (set_id=export)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:47:48 dovecot_login authenticator failed for H=(7ZRiWV1) [77.83.39.164]:65461: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2026-02-03 03:48:05 dovecot_login authenticator failed for H=([102.110.11.48]) [102.110.11.48]:2491: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:48:09 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:48:12 dovecot_login authenticator failed for H=(MH5swO) [77.83.39.164]:58858: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:48:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49866: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:48:08 dovecot_login authenticator failed for H=(gowO0j) [185.36.81.54]:50610: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:49:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:48:06 dovecot_login authenticator failed for H=(lKjpJU40nU) [178.16.52.139]:63756: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:48:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52134: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/tmpfiles.d/dnf.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-02-03 03:48:15 dovecot_login authenticator failed for H=([211.53.58.10]) [211.53.58.10]:65342: 535 Incorrect authentication data (set_id=rnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.197.117.245
country_id: 6252001
description:
2026-02-03 03:48:41 dovecot_plain authenticator failed for H=(crioloce) [67.197.117.245]:37715: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:48:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(77.83.39.164)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:49:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:49:24 dovecot_login authenticator failed for H=(NTxaG4cq) [185.36.81.54]:63397: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:49:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58763: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:49:03 dovecot_login authenticator failed for H=(1ZbiOpnN) [178.16.52.139]:59491: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.88.129.112
country_id: 1522867
description:
2026-02-03 03:49:25 dovecot_login authenticator failed for H=178.88.129.112.dynamic.telecom.kz [178.88.129.112]:34091: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:49:03 dovecot_login authenticator failed for H=(kamUaM599S) [185.36.81.54]:59230: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 03:49:13 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:53173: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.245.170
country_id: 3469034
description:
2026-02-03 03:49:39 dovecot_login authenticator failed for H=([187.76.245.170]) [187.76.245.170]:52069: 535 Incorrect authentication data (set_id=general)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/tmpfiles.d/static-nodes-permissions.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:49:14 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:49:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(77.83.39.164)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:49:24 dovecot_login authenticator failed for H=(Ey2hN7Olv8) [77.83.39.164]:53942: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:49:14 H=(185.93.89.63) [185.93.89.63]:54754 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <drapela@northcoasttoolinc.com>: host lookup did not complete


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:50:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(77.83.39.164)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:50:23 H=(185.93.89.63) [185.93.89.63]:54937 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dmorris@smalltownbank.com>: The mail server could not deliver mail to dmorris@smalltownbank.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:50:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53208: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.104.12
country_id: 1880251
domain: visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/m.php||SC:/home/visoftcom/public_html/images/m.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.184.1.9
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7442519ee04885fa5c3ad7cb9fbc7e5d573f075e||Title:0x45c13937||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:50:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:50:55 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:50:13 dovecot_login authenticator failed for H=(NiwMI00jX0) [77.83.39.164]:65441: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/etc/security/user_map.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:50:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49326: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:50:08 dovecot_login authenticator failed for H=(QvwYFZv) [185.36.81.54]:55457: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:50:15 dovecot_login authenticator failed for H=(qa5DvMKuj) [178.16.52.139]:51687: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-03 03:50:24 +0800] info [cpaneld] 185.204.54.153 - lvconsul "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvconsul (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:51:25 dovecot_login authenticator failed for H=(5wxDNRhRJ) [77.83.39.164]:62369: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:51:10 dovecot_login authenticator failed for H=(KAS5yOSR) [185.36.81.54]:62726: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:51:11 dovecot_login authenticator failed for H=(XE7m2TvXgh) [178.16.52.139]:54615: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.184.1.9
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dcf5848be3f6fa494f46e44802211a4743a3fd40||Title:0x42352673||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:51:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(77.83.39.164)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:51:45 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:51:57 dovecot_login authenticator failed for H=(5KTXIkyBZ) [185.36.81.54]:56943: 535 Incorrect authentication data (set_id=ind)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/etc/systemd/system.conf||User:root||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:51:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:51:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61371: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.135.75
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:52:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54264: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:52:12 dovecot_login authenticator failed for H=(25w8opuFmX) [77.83.39.164]:56619: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:52:29 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:52:30 dovecot_login authenticator failed for H=(obpTbZ) [178.16.52.139]:57568: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/2448831/root/lib/kernel/install.conf||User:root||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:52:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(77.83.39.164)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:52:18 H=(185.93.89.63) [185.93.89.63]:55447 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <andrea@pecasolighting.net>: The mail server could not deliver mail to andrea@pecasolighting.net.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:52:19 dovecot_login authenticator failed for H=(2lG6HXG) [185.36.81.54]:57484: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:52:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:52:33 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:53:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49632: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:53:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:53:21 H=(185.93.89.63) [185.93.89.63]:55645 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jpace@venturetech.biz>: The mail server could not deliver mail to jpace@venturetech.biz.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:53:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(77.83.39.164)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/etc/security/pwquality.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:53:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60002: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:53:10 dovecot_login authenticator failed for H=(DahbkDQ06) [185.36.81.54]:64503: 535 Incorrect authentication data (set_id=ind)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.184.1.9
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd5334bd8dbe05253be30a999290c3be516c8c14||Title:0x109c52a3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:53:33 dovecot_login authenticator failed for H=(Ds3wDpyt1) [178.16.52.139]:55970: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:53:27 dovecot_login authenticator failed for H=(6xDIS3p3) [77.83.39.164]:56641: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:54:04 dovecot_login authenticator failed for H=(szbnqCyS) [178.16.52.139]:56247: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:54:11 dovecot_login authenticator failed for H=(cirVESx) [185.36.81.54]:62513: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2026-02-03 03:54:36 dovecot_login authenticator failed for H=([103.129.195.43]) [103.129.195.43]:38763: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:54:17 dovecot_login authenticator failed for H=(TfiGFf7bdO) [77.83.39.164]:58732: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2026-02-03 03:54:46 dovecot_login authenticator failed for H=([125.154.62.229]) [125.154.62.229]:43983: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:54:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ind has been locked for the attacker IP 185.36.81.54


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/mysql_system_tables.sql||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:54:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58974: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.207.69.66
country_id: 6252001
description:
2026-02-03 03:54:48 dovecot_plain authenticator failed for H=173-207-69-66.cpe.cableone.net (cyned) [173.207.69.66]:48718: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.184.1.9
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c0577849ca7456286a87cfe265218e22acd67ef||Title:0x5088819f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:54:10 dovecot_login authenticator failed for H=(eH9IP3qy) [185.36.81.54]:63100: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:54:07 H=(185.93.89.63) [185.93.89.63]:55740 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <swarren@hi-caliber-it.com>: The mail server could not deliver mail to swarren@hi-caliber-it.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:55:04 dovecot_login authenticator failed for H=(kdyEMiF5) [185.36.81.54]:53890: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.184.1.9
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:43f2aaf9ed20758dd857a32991ca4511efe21a9a||Title:0x0544ee93||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.195.41
country_id: 1814991
description:
2026-02-03 03:55:46 dovecot_login authenticator failed for H=([120.234.195.41]) [120.234.195.41]:58981: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:55:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:55:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57940: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:55:09 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:55:07 dovecot_login authenticator failed for H=(CThXv5tda) [77.83.39.164]:57038: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:55:11 dovecot_login authenticator failed for H=(OxSPgKAgd) [178.16.52.139]:61016: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 03:55:56 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:49154: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.103.30
country_id: 1814991
description:
2026-02-03 03:55:57 dovecot_login authenticator failed for H=([36.135.103.29]) [36.135.103.30]:40468: 535 Incorrect authentication data (set_id=sham)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.120
country_id: 1835841
description:
2026-02-03 03:55:59 dovecot_login authenticator failed for H=([61.72.145.120]) [61.72.145.120]:49941: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:55:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55636: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:55:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.16.40.3
country_id: 1814991
description:
2026-02-03 03:55:44 dovecot_login authenticator failed for H=([110.16.40.3]) [110.16.40.3]:22940: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:56:21 dovecot_login authenticator failed for H=(gnhGMJaXy) [185.36.81.54]:52142: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:56:05 H=(185.93.89.63) [185.93.89.63]:56139 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <avionics@crownaviation.com>: The mail server could not deliver mail to avionics@crownaviation.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:56:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(77.83.39.164)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:56:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ind has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:56:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51127: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:56:16 dovecot_login authenticator failed for H=(loYp6ZAisC) [178.16.52.139]:63894: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:56:19 dovecot_login authenticator failed for H=(a8Ultd0nd3) [77.83.39.164]:61567: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:56:21 dovecot_login authenticator failed for H=(KgCfVk) [185.36.81.54]:52563: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:56:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa has been temporarily locked by Imunify PAM(185.36.81.54)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  3 03:56:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


