# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:35:21 dovecot_login authenticator failed for H=(0zbfx5k) [158.94.208.175]:52054: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-02-02 12:36:01 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:38572: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:35:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60709: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:35:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-02 12:35:16 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:54980: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 12:35:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson@oxbold.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:35:12 dovecot_login authenticator failed for H=(HDXDQIl) [165.154.254.163]:51448: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:35:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:35:15 dovecot_login authenticator failed for H=(gEJ7STr) [165.154.235.122]:56675: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:36:05 dovecot_login authenticator failed for H=(oUKP1zCVL) [158.94.208.175]:55703: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:36:09 dovecot_login authenticator failed for H=(Ug1vpr) [165.154.254.163]:56673: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:36:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:36:17 dovecot_login authenticator failed for H=(GgsSlP) [165.154.235.122]:51972: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:36:51 dovecot_login authenticator failed for H=(03MbWg5L) [158.94.208.110]:56960: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:36:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54054: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-02-02 12:36:07 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.98.104.138]:52006: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2026-02-02 12:36:12 dovecot_login authenticator failed for H=(31-154-88-152.orange.net.il) [2.55.88.152]:33983: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:37:00 dovecot_login authenticator failed for H=(aPM0xK) [158.94.211.83]:58392: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-02-02 12:36:16 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:34330: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-02-02 12:36:22 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:58898: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.205.78.197
country_id: 1694008
domain: jpack.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:65240.jpack.com.my||ServerName:jpack.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:774eb98ba539deb65d3fcbbec5803672e317d2c2||Title:0x3078497d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:37:15 dovecot_login authenticator failed for H=(QNbJEddk7) [158.94.208.110]:60959: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-02-02 12:37:47 dovecot_plain authenticator failed for H=(ening) [65.20.143.159]:38262: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:37:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:37:06 dovecot_login authenticator failed for H=(oYsDIvkst) [165.154.254.163]:59650: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:37:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65147: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:37:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:37:14 dovecot_login authenticator failed for H=(oMZzaDk) [165.154.235.122]:61737: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:37:11 dovecot_login authenticator failed for H=(7oxWnv0d) [158.94.208.175]:64475: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:37:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41736: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:37:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
country_id: 1814991
description:
2026-02-02 12:37:39 dovecot_login authenticator failed for H=([111.39.206.23]) [111.39.206.23]:43260: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:37:53 dovecot_login authenticator failed for H=(9X6k2Ckh) [165.154.235.122]:63494: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:37:23 dovecot_login authenticator failed for H=(TyXx2OPJ) [158.94.211.83]:58749: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2026-02-02 12:37:23 dovecot_login authenticator failed for H=([183.6.43.236]) [183.6.43.236]:49758: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.145.150.158
country_id: 6252001
description:
[2026-02-02 12:38:53 +0800] info [cpaneld] 67.145.150.158 - kdibal "GET /login/?login_only=1&user=kdibal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdibal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.203.123.235
country_id: 6252001
description:
[2026-02-02 12:39:01 +0800] info [cpaneld] 170.203.123.235 - kd "GET /login/?login_only=1&user=kd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.177.48.183
country_id: 6252001
description:
[2026-02-02 12:38:41 +0800] info [cpaneld] 47.177.48.183 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-02-02 12:38:45 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (fulantly) [98.40.101.10]:39050: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.186.117.66
country_id: 6252001
description:
[2026-02-02 12:38:57 +0800] info [cpaneld] 204.186.117.66 - kdib "GET /login/?login_only=1&user=kdib&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdib (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:38:04 dovecot_login authenticator failed for H=(KMORDcTJR8) [165.154.254.163]:62344: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:38:12 dovecot_login authenticator failed for H=(GW1dS5wdkx) [165.154.235.122]:60354: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:38:22 dovecot_login authenticator failed for H=(ohd16ZPjyD) [158.94.208.175]:56110: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.21.186.139
country_id: 6252001
description:
[2026-02-02 12:38:46 +0800] info [cpaneld] 67.21.186.139 - kdiballoo "GET /login/?login_only=1&user=kdiballoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiballoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.44.115
country_id: 6252001
description:
[2026-02-02 12:38:48 +0800] info [cpaneld] 172.56.44.115 - kdiballo "GET /login/?login_only=1&user=kdiballo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiballo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.58.9.47
country_id: 6252001
description:
[2026-02-02 12:38:59 +0800] info [cpaneld] 104.58.9.47 - kdi "GET /login/?login_only=1&user=kdi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:38:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60152: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:38:04 dovecot_login authenticator failed for H=(dxDhpQpF) [158.94.208.110]:52400: 535 Incorrect authentication data (set_id=kl.tai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:38:09 dovecot_login authenticator failed for H=(TqaZ51H0RG) [158.94.211.83]:56520: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.153.111.47
country_id: 6252001
description:
[2026-02-02 12:38:39 +0800] info [cpaneld] 184.153.111.47 - kdiballoon "GET /login/?login_only=1&user=kdiballoon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiballoon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.1.18.52
country_id: 6252001
description:
[2026-02-02 12:38:43 +0800] info [cpaneld] 73.1.18.52 - kdiballooncom "GET /login/?login_only=1&user=kdiballooncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiballooncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.27.213.19
country_id: 6252001
description:
[2026-02-02 12:38:50 +0800] info [cpaneld] 45.27.213.19 - kdiball "GET /login/?login_only=1&user=kdiball&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiball (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.134.23.79
country_id: 6252001
description:
[2026-02-02 12:38:55 +0800] info [cpaneld] 76.134.23.79 - kdiba "GET /login/?login_only=1&user=kdiba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiba (has_cpuser_file failed)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:38:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:38:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:39:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:39:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:39:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64438: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 12:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:22987: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:39:04 dovecot_login authenticator failed for H=(jKZAld4) [158.94.208.175]:57063: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:39:09 dovecot_login authenticator failed for H=(KFSHOPxnR) [165.154.235.122]:54326: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:39:18 dovecot_login authenticator failed for H=(Oy6UjUHt49) [158.94.211.83]:54170: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:39:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57420: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.85.149.121
country_id: 6252001
description:
[2026-02-02 12:39:04 +0800] info [cpaneld] 97.85.149.121 - kdiball1 "GET /login/?login_only=1&user=kdiball1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiball1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:39:20 dovecot_login authenticator failed for H=(H2SM6vKiYy) [165.154.254.163]:59180: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:39:14 dovecot_login authenticator failed for H=(8lv3KMENhU) [158.94.208.110]:63893: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:40:06 dovecot_login authenticator failed for H=(JXb6a5) [165.154.235.122]:62881: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:40:17 dovecot_login authenticator failed for H=(ZQOmLx48B) [165.154.254.163]:60516: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:40:21 dovecot_login authenticator failed for H=(D6yk6mT9Yu) [158.94.208.175]:63008: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:40:48 dovecot_login authenticator failed for H=(XXnJfA) [158.94.208.110]:62717: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:40:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:40:04 dovecot_login authenticator failed for H=(jiqIyZ) [158.94.211.83]:59993: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 12:40:46 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:56524: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:40:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:40:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:40:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60585: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:41:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 12:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:45938: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-02-02 12:41:11 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:50566: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:41:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:41:14 dovecot_login authenticator failed for H=(nmEQeV) [165.154.254.163]:61520: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:41:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51156: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.91.64.8
country_id: 2017370
description:
45.91.64.8 - - [02/02/2026:04:41:52 -0000] "GET /cPanel_magic_revision_1748449569/unprotected/cpanel/fonts/open_sans/open_sans.min.css HTTP/1.1" 200 0 "https://42.0.28.63:2083/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063144&pdata=https%253A%252F%252F42.0.28.63%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1770007306" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" "-" "-" 2083


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:41:03 dovecot_login authenticator failed for H=(t5DSJu) [165.154.235.122]:64305: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:41:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55334: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.118.149
country_id: 1269750
description:
2026-02-02 12:41:28 dovecot_plain authenticator failed for H=(58F1THHLM15) [49.36.118.149]:61104: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:41:33 dovecot_login authenticator failed for H=(e2gzY00uP) [158.94.208.175]:55126: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:41:12 dovecot_login authenticator failed for H=(hLRKT9) [158.94.208.110]:59853: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.32.195.85
country_id: 174982
description:
176.32.195.85 - - [02/02/2026:04:41:51 -0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063144&pdata=https%253A%252F%252F42.0.28.63%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1770007306 HTTP/1.1" 404 0 "https://42.0.28.63:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" "-" "-" 2083


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:41:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:41:13 dovecot_login authenticator failed for H=(56v5IJ) [158.94.211.83]:56191: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:42:22 dovecot_login authenticator failed for H=(SA53S7mcv) [158.94.211.83]:54886: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-02-02 12:42:04 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:53022: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:42:11 dovecot_login authenticator failed for H=(xmlIolk) [165.154.254.163]:62335: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:42:19 dovecot_login authenticator failed for H=(fm1hgY) [165.154.235.122]:62678: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:42:30 dovecot_login authenticator failed for H=(zuUvAyhr) [165.154.254.163]:51937: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:42:05 dovecot_login authenticator failed for H=(Okd5fL) [158.94.208.175]:56569: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-02-02 12:42:13 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:46814: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:42:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:42:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50807: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:43:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62795: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:43:08 dovecot_login authenticator failed for H=(aVmcjrvau8) [158.94.211.83]:54038: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:43:09 dovecot_login authenticator failed for H=(MtxqotxrZU) [158.94.208.175]:57945: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2026-02-02 12:43:12 dovecot_login authenticator failed for H=([112.186.241.102]) [112.186.241.102]:46800: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:43:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:43:16 dovecot_login authenticator failed for H=(FSK6UiBZ) [165.154.235.122]:59553: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-02-02 12:43:22 dovecot_login authenticator failed for H=([152.52.192.162]) [152.52.192.162]:58074: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:43:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:43:09 dovecot_login authenticator failed for H=(0nQN11) [165.154.254.163]:63975: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:43:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:44:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:44:17 dovecot_login authenticator failed for H=(AgN8Udj7Zr) [158.94.211.83]:57377: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:44:19 dovecot_login authenticator failed for H=(grRdQPtID) [158.94.208.175]:54484: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:44:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56895: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:44:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:44:06 dovecot_login authenticator failed for H=(aaS6JdtB) [165.154.254.163]:50163: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:44:14 dovecot_login authenticator failed for H=(PrksuhiLy) [165.154.235.122]:53976: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:44:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.145.62
country_id: 1835841
description:
2026-02-02 12:45:35 dovecot_login authenticator failed for H=([125.140.145.62]) [125.140.145.62]:44281: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:45:03 dovecot_login authenticator failed for H=(g1uMc41HZ) [158.94.211.83]:61737: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:45:18 dovecot_login authenticator failed for H=(TzHh9j) [158.94.208.175]:60213: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/es/images/team.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:46:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35850: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:45:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:45:09 dovecot_login authenticator failed for H=(Q5wGjn1wyt) [165.154.254.163]:53889: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:45:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.133
country_id: 1814991
description:
2026-02-02 12:45:45 dovecot_login authenticator failed for H=([223.166.105.133]) [223.166.105.133]:47802: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:45:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50998: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.195.41
country_id: 1814991
description:
2026-02-02 12:46:00 dovecot_login authenticator failed for H=([120.234.195.41]) [120.234.195.41]:50124: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:45:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:45:11 dovecot_login authenticator failed for H=(3h9TBvXDIw) [165.154.235.122]:62118: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:46:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:46:08 dovecot_login authenticator failed for H=(HpOVmP) [165.154.235.122]:55564: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-02-02 12:46:38 dovecot_plain authenticator failed for H=(citer) [65.20.160.107]:51202: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:46:06 dovecot_login authenticator failed for H=(crrzGnA) [165.154.254.163]:55897: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:46:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-02-02 12:46:15 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:60560: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-02-02 12:46:24 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:50410: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:46:26 dovecot_login authenticator failed for H=(kodt9L) [158.94.208.175]:54313: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:46:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56762: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-02-02 12:46:42 dovecot_plain authenticator failed for H=(matimparts) [204.144.187.196]:44370: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:46:12 dovecot_login authenticator failed for H=(PuvW2gY) [158.94.211.83]:54099: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:46:25 dovecot_login authenticator failed for H=(b9Ttgb5Y) [165.154.254.163]:61724: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:47:12 dovecot_login authenticator failed for H=(6Sm19881y) [165.154.254.163]:59144: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:47:21 dovecot_login authenticator failed for H=(pIZgW9lz57) [158.94.211.83]:65499: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:47:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51142: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.4.189
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=1&sub=10 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:47:04 dovecot_login authenticator failed for H=(K7pnUC0R) [165.154.235.122]:56826: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:47:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:47:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:47:28 dovecot_login authenticator failed for H=(SZrFZZ) [158.94.208.175]:58116: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:47:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:48:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:48:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:48:10 dovecot_login authenticator failed for H=(7BVUOvsfr) [165.154.254.163]:59956: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:48:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:48:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:48:21 dovecot_login authenticator failed for H=(pZYJKj) [165.154.235.122]:60987: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:48:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62599: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:48:07 dovecot_login authenticator failed for H=(uPh2qziJ) [158.94.208.175]:55073: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:48:07 dovecot_login authenticator failed for H=(yxAtJ2Vqa) [158.94.211.83]:56501: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:48:29 dovecot_login authenticator failed for H=(Hmr0BWufX) [165.154.235.122]:50241: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:48:31 dovecot_login authenticator failed for H=(LEGGj3m) [158.94.208.110]:64298: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 12:48:20 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (bokovilic) [87.103.126.54]:43539: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-02-02 12:48:08 dovecot_plain authenticator failed for H=(under) [185.107.136.187]:55850: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:49:16 dovecot_login authenticator failed for H=(zAkWWZb) [158.94.211.83]:52198: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:49:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 12:50:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58380: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:49:53 dovecot_login authenticator failed for H=(OR6CpQJ3ab) [45.94.31.131]:63135: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-02-02 12:49:56 dovecot_plain authenticator failed for H=(wited) [91.73.188.251]:44264: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:49:08 dovecot_login authenticator failed for H=(XCmGLsuf) [165.154.254.163]:60935: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:49:08 dovecot_login authenticator failed for H=(Sro78hELl4) [165.154.235.122]:61908: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:49:09 dovecot_login authenticator failed for H=(rE60de) [158.94.208.175]:52289: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:49:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56194: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:49:19 dovecot_login authenticator failed for H=(Un625zsea) [158.94.208.110]:55724: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:50:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:50:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:50:05 dovecot_login authenticator failed for H=(3CLJsU) [165.154.235.122]:54830: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 12:50:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58380: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:50:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35222: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:50:29 dovecot_login authenticator failed for H=(Uy60kZ26V) [158.94.208.110]:51190: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:50:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:50:05 dovecot_login authenticator failed for H=(itHJXIW) [165.154.254.163]:61870: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:50:16 dovecot_login authenticator failed for H=(Xo8h5lBTe) [158.94.208.175]:57085: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.193.207.88
country_id: 1694008
domain: kainanholding.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55715.kainanholding.com||ServerName:kainanholding.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c58ba36379c08e0ee5784f0e675ebe0063e28e48||Title:0xf125794f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:50:15 dovecot_login authenticator failed for H=(MU8iKrhLp) [45.94.31.131]:64870: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:50:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50078: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.234.13.40
country_id: 2017370
description:
2026-02-02 12:50:57 dovecot_login authenticator failed for H=(pppoe-109.234.13.40.gaztelecom.ru) [109.234.13.40]:56082: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:50:25 dovecot_login authenticator failed for H=(kRXaP6If4) [158.94.211.83]:51668: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:51:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:51:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.238
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:51:03 dovecot_login authenticator failed for H=(KHHnZzYBI) [165.154.235.122]:49419: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:51:17 dovecot_login authenticator failed for H=(q9plxNgDm) [158.94.208.175]:53193: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2026-02-02 12:51:25 dovecot_login authenticator failed for H=([136.228.168.12]) [136.228.168.12]:57416: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-02-02 12:51:47 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (herestic) [73.68.220.15]:36852: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:51:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:51:17 dovecot_login authenticator failed for H=(1TyftCwlj) [158.94.208.110]:58848: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:51:21 dovecot_login authenticator failed for H=(tle8DvRkq) [165.154.254.163]:51135: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:51:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60382: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:51:11 dovecot_login authenticator failed for H=(RXM8rl) [158.94.211.83]:63927: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:51:15 dovecot_login authenticator failed for H=(fR0flgBFa) [45.94.31.131]:62372: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 101.51.106.149
country_id: 1605651
description:
2026-02-02 12:51:23 287931 [Warning] Aborted connection 287931 to db: 'unconnected' user: 'unauthenticated' host: '101.51.106.149' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:52:27 dovecot_login authenticator failed for H=(z4NV0t) [158.94.208.110]:54199: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:52:18 dovecot_login authenticator failed for H=(GQqKcQ2EF) [165.154.254.163]:50833: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:52:18 dovecot_login authenticator failed for H=(T6EjTBh) [45.94.31.131]:64930: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:52:20 dovecot_login authenticator failed for H=(ZMAadi5Wrn) [165.154.235.122]:50804: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:52:20 dovecot_login authenticator failed for H=(TO2oStn) [158.94.211.83]:54617: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:52:20 dovecot_login authenticator failed for H=(8Fi83W) [158.94.208.175]:60009: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:52:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46604: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:52:40 dovecot_login authenticator failed for H=(ceqmlZ) [165.154.235.122]:54240: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 12:52:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:52:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56554: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:52:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:52:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:53:05 dovecot_login authenticator failed for H=(A5NrmKBUbF) [158.94.208.175]:53284: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:53:05 dovecot_login authenticator failed for H=(TQJMPHhTf) [165.154.235.122]:53456: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:53:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:53:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 12:53:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:53:06 dovecot_login authenticator failed for H=(BwGJ8T) [158.94.211.83]:52098: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 12:53:15 dovecot_login authenticator failed for H=(q9DxQMd21W) [158.94.208.110]:62291: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:53:16 dovecot_login authenticator failed for H=(45m4uIwxG) [165.154.254.163]:50863: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:53:17 dovecot_login authenticator failed for H=(eJ0VgSl) [45.94.31.131]:57922: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:53:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57981: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:54:19 dovecot_login authenticator failed for H=(qJ6ReXJLda) [45.94.31.131]:55856: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:54:13 dovecot_login authenticator failed for H=(ddgUcmV9oJ) [165.154.254.163]:51670: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:54:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 12:54:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:54:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39262: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2026-02-02 12:54:27 dovecot_login authenticator failed for H=217.42.246.220.static.netvigator.com [220.246.42.217]:63414: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:54:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53271: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:54:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:54:15 dovecot_login authenticator failed for H=(zywZM7TE) [158.94.211.83]:52291: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.202
country_id: 1269750
description:
2026-02-02 12:54:18 dovecot_login authenticator failed for H=([125.20.249.53]) [128.185.215.202]:50302: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:54:03 dovecot_login authenticator failed for H=(zOQ7kq7) [165.154.235.122]:61767: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:55:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(158.94.211.83)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:55:23 dovecot_login authenticator failed for H=(KcnykA3Qe) [45.94.31.131]:59111: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:55:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64478: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:55:01 dovecot_login authenticator failed for H=(0iEjkBTTPc) [158.94.211.83]:52083: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:55:04 dovecot_login authenticator failed for H=(B4Y2xhp) [165.154.235.122]:50154: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 12:55:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:55:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:55:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:55:13 dovecot_login authenticator failed for H=(MdeUatRIUq) [165.154.254.163]:53481: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:55:35 dovecot_login authenticator failed for H=(BaYcla) [158.94.208.175]:52098: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:56:20 dovecot_login authenticator failed for H=(Eugz9pk) [165.154.235.122]:53134: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:56:06 dovecot_login authenticator failed for H=(bc49xIVPlg) [158.94.208.175]:63604: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:56:10 dovecot_login authenticator failed for H=(NYldB5a) [158.94.211.83]:58659: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:56:11 dovecot_login authenticator failed for H=(F3tEuu3YPu) [165.154.254.163]:59001: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:56:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:56:40 dovecot_login authenticator failed for H=(EHc0LAfyi) [165.154.235.122]:60023: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 12:56:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:56:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36116: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:56:02 dovecot_login authenticator failed for H=(2bSXcoU) [45.94.31.131]:59912: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:56:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58826: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:57:09 dovecot_login authenticator failed for H=(g1nyyC) [165.154.254.163]:62594: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:57:03 dovecot_login authenticator failed for H=(IrUXjXNQ0) [45.94.31.131]:62982: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 12:57:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:57:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53429: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:57:18 dovecot_login authenticator failed for H=(totaPlBl) [165.154.235.122]:57147: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:57:19 dovecot_login authenticator failed for H=(1hFWViNm) [158.94.211.83]:50307: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:57:12 dovecot_login authenticator failed for H=(aKYzWcI9) [158.94.208.175]:57104: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:57:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.90.68
country_id: 1814991
description:
2026-02-02 12:57:25 dovecot_login authenticator failed for H=([124.152.90.68]) [124.152.90.68]:51783: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-02-02 12:57:36 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:28486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:58:07 dovecot_login authenticator failed for H=(yB4O9sNCNj) [165.154.254.163]:49467: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:58:14 dovecot_login authenticator failed for H=(HwZESIwxj) [158.94.208.175]:54579: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:58:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63174: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:58:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:58:20 dovecot_login authenticator failed for H=(F6JAMmS7gv) [45.94.31.131]:54131: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 12:58:22 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:61069: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:58:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:58:02 dovecot_login authenticator failed for H=(G98k069) [165.154.235.122]:65473: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:58:05 dovecot_login authenticator failed for H=(AYLjeH2m3r) [158.94.211.83]:64483: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 12:59:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 12:59:06 dovecot_login authenticator failed for H=(wHsfpF) [165.154.254.163]:52408: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.186.93
country_id: 1562822
description:
2026-02-02 12:59:12 dovecot_login authenticator failed for H=([127.0.0.1]) [113.160.186.93]:33506: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 12:59:14 dovecot_login authenticator failed for H=(gltEoMtW2x) [158.94.211.83]:62155: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.241.206.35
country_id: 2635167
description:
2026-02-02 12:59:18 dovecot_login authenticator failed for H=([127.0.0.1]) [145.241.206.35]:57956: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 12:59:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51868: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 12:59:30 dovecot_login authenticator failed for H=(lrjvNvHmoM) [158.94.208.175]:51908: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 12:59:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 12:59:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58100: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 12:59:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 12:59:19 dovecot_login authenticator failed for H=(fdWA2I) [165.154.235.122]:55776: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 12:59:21 dovecot_login authenticator failed for H=(KUczC5vWV) [45.94.31.131]:60143: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:00:16 dovecot_login authenticator failed for H=(Sgi0wuV) [165.154.235.122]:56724: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:00:20 dovecot_login authenticator failed for H=(W5RAyYo9) [45.94.31.131]:57868: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:00:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62705: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:00:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.65.144.39
country_id: 2921044
description:
2026-02-02 13:00:12 dovecot_plain authenticator failed for H=([176.65.144.39]) [176.65.144.39]:62624: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:00:35 dovecot_login authenticator failed for H=(gHLCInb3DE) [165.154.235.122]:55964: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 13:00:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:00:09 dovecot_login authenticator failed for H=(Ea73n5oug) [158.94.208.175]:53932: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:00:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:00:03 dovecot_login authenticator failed for H=(hdXUULL) [165.154.254.163]:55391: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:00:23 dovecot_login authenticator failed for H=(LHFBGG5P) [158.94.211.83]:59733: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:01:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:01:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:01:22 dovecot_login authenticator failed for H=(se6ZvRH) [45.94.31.131]:61786: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:01:03 dovecot_login authenticator failed for H=(thFIqD) [165.154.254.163]:58980: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:01:09 dovecot_login authenticator failed for H=(NbLvnSfx) [158.94.211.83]:62746: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:01:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37838: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:01:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56692: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 13:01:29 288295 [Warning] Aborted connection 288295 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:01:14 dovecot_login authenticator failed for H=(115hCrF) [165.154.235.122]:61336: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:01:18 dovecot_login authenticator failed for H=(vhBneQmis) [158.94.208.175]:60443: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 13:01:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.79.159.68
country_id: 2802361
description:
Feb  2 13:02:00 sv3 pure-ftpd[1806290]: (?@34.79.159.68) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 13:02:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:02:06 dovecot_login authenticator failed for H=(LU5MO1p) [45.94.31.131]:54164: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:02:18 dovecot_login authenticator failed for H=(InLuuos9Z) [158.94.211.83]:58604: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:02:21 dovecot_login authenticator failed for H=(12KVuimejN) [158.94.208.175]:58848: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:02:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:02:12 dovecot_login authenticator failed for H=(jyDlZyx6) [165.154.235.122]:64657: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:02:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50540: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:02:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry has been temporarily locked by Imunify PAM(165.154.254.163)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:02:19 dovecot_login authenticator failed for H=(ts7b9ypZdU) [165.154.254.163]:51821: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.34.183
country_id: 2802361
description:
Feb  2 13:02:40 sv3 pure-ftpd[1806795]: (?@34.76.34.183) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.66.181.107
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/award-she.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:03:06 dovecot_login authenticator failed for H=(G0BWu3B2m3) [45.94.31.131]:57814: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:03:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:03:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64556: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:03:16 dovecot_login authenticator failed for H=(UQuwXsNFM) [165.154.254.163]:53726: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:03:23 dovecot_login authenticator failed for H=(KoWUaFc) [158.94.208.175]:63649: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:03:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60426: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 13:03:24 +0800] info [cpaneld] 185.204.54.153 - akgnal "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user akgnal (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:03:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 13:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:03:04 dovecot_login authenticator failed for H=(hWTu9vRC) [158.94.211.83]:57451: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:03:10 dovecot_login authenticator failed for H=(3wlH3bzKG5) [165.154.235.122]:63476: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.163
country_id: 2750405
description:
2026-02-02 13:03:49 288380 [Warning] Aborted connection 288380 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.163' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:04:13 dovecot_login authenticator failed for H=(d9DshfH) [165.154.254.163]:56869: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:04:52 dovecot_login authenticator failed for H=(ikIKOzAk) [165.154.254.163]:53854: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:04:08 dovecot_login authenticator failed for H=(O7cMMiOpis) [165.154.235.122]:52896: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:04:13 dovecot_login authenticator failed for H=(bfwhtfB6C) [158.94.211.83]:51161: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 13:04:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:04:06 dovecot_login authenticator failed for H=(zU9R8kk) [45.94.31.131]:64068: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:04:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:04:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52960: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:04:27 dovecot_login authenticator failed for H=(TyEC9xxO) [158.94.208.175]:64712: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:04:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:05:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:05:22 dovecot_login authenticator failed for H=(LTrznNjjz) [158.94.211.83]:59168: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:05:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45148: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.207.58.232
country_id: 1269750
domain: kdiballoon.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23020.kdiballoon.com||ServerName:kdiballoon.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c5bfa6124d1e2bbe428e12479215e1f70d5591f||Title:0x04e9a919||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:05:07 dovecot_login authenticator failed for H=(aO8v7xTfBH) [45.94.31.131]:62747: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:05:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63417: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:05:11 dovecot_login authenticator failed for H=(RzmYtP6e) [165.154.254.163]:60144: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:05:07 dovecot_login authenticator failed for H=(bFJqBZ) [165.154.235.122]:51481: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.14.118.150
country_id: 2802361
description:
Feb  2 13:05:26 sv3 pure-ftpd[1809291]: (?@34.14.118.150) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 13:05:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:06:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56854: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:06:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:06:08 dovecot_login authenticator failed for H=(6BgJkcbth8) [158.94.211.83]:61697: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:06:08 dovecot_login authenticator failed for H=(ulycqlY0AB) [158.94.208.175]:55454: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.90
country_id: 3624060
description:
2026-02-02 13:06:12 dovecot_login authenticator failed for H=([127.0.0.1]) [186.177.88.90]:59838: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:06:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-02-02 13:06:34 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:46112: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:06:08 dovecot_login authenticator failed for H=(O6j89A2izO) [45.94.31.131]:58869: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:06:09 dovecot_login authenticator failed for H=(ppWV3Rh) [165.154.254.163]:62403: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.15.166.101
country_id: 2510769
description:
2026-02-02 13:06:19 dovecot_login authenticator failed for H=101.red-88-15-166.dynamicip.rima-tde.net ([127.0.0.1]) [88.15.166.101]:57176: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:06:05 dovecot_login authenticator failed for H=(p3ydJmuD) [165.154.235.122]:50507: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:07:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2026-02-02 13:07:26 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:37540: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:07:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54594: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:07:06 dovecot_login authenticator failed for H=(qojbCpRP1P) [45.94.31.131]:58085: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:07:09 dovecot_login authenticator failed for H=(Gi9RkZunpN) [165.154.254.163]:65457: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:07:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61768: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:07:09 dovecot_login authenticator failed for H=(wi3NxhwkI) [158.94.208.175]:57170: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:07:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:07:17 dovecot_login authenticator failed for H=(EFISbPcIY9) [158.94.211.83]:58127: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.151.20
country_id: 1210997
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/facilities.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:07:12 dovecot_login authenticator failed for H=(G92wZ8P) [165.154.235.122]:49647: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-02-02 13:08:23 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:60664: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:08:06 dovecot_login authenticator failed for H=(QMGH8On067) [165.154.254.163]:63865: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.232.26
country_id: 3469034
description:
2026-02-02 13:08:23 dovecot_login authenticator failed for H=(187-40-1-41.user.veloxzone.com.br) [200.223.232.26]:38883: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:09:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23563: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:08:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-02-02 13:08:08 dovecot_login authenticator failed for H=([1.250.67.114]) [1.250.67.114]:33518: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:08:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55962: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:08:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:08:03 dovecot_login authenticator failed for H=(CnykPuKOz) [158.94.211.83]:50856: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:08:06 dovecot_login authenticator failed for H=(Ba1Q7vqgs) [45.94.31.131]:58026: 535 Incorrect authentication data (set_id=aj.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:08:10 dovecot_login authenticator failed for H=(nTyKBYVBnu) [165.154.235.122]:56423: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:08:28 dovecot_login authenticator failed for H=(Fs0i9DU88) [158.94.208.175]:54888: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-02-02 13:08:33 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:52486: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:09:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:09:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50382: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:09:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41592: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:09:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23563: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 13:09:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aj.sales has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:09:08 dovecot_login authenticator failed for H=(vjR0xf1nk) [165.154.235.122]:49669: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140866
name: IM360 WAF: Malicious plugin upload attempt
abuser: 146.103.40.55
country_id: 2921044
domain: tujusetia.my
description:
IM360 WAF: Malicious plugin upload attempt||MVN:FILES:my-theme||WPU:||RSV:7.71||T:APACHE||MV:rock.zip||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:09:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:09:12 dovecot_login authenticator failed for H=(ujvuUlIUFA) [158.94.211.83]:56213: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:09:36 dovecot_login authenticator failed for H=(wwbuyH) [158.94.208.175]:55671: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140924
name: IM360 WAF: WordPress Cherry-Plugin File Upload Vulnerability
abuser: 146.103.40.55
country_id: 2921044
domain: tujusetia.my
description:
IM360 WAF: WordPress Cherry-Plugin File Upload Vulnerability||MVN:FILES:file||WPU:||RSV:7.71||T:APACHE||MV:files/settings_auto.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 13:10:02 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (pablue) [87.103.126.54]:45123: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 13:09:08 dovecot_login authenticator failed for H=(H6dDPmhYpU) [45.94.31.131]:51375: 535 Incorrect authentication data (set_id=aj.sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.108.216
country_id: 3469034
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/index.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:09:23 dovecot_login authenticator failed for H=(eF9Caq) [165.154.254.163]:64451: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77222050
abuser: 146.103.40.55
country_id: 2921044
domain: tujusetia.my
name:
IM360 WAF: Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress (CVE-2014-9734)

description:
IM360 WAF: Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress (CVE-2014-9734)||MVN:REQUEST_FILENAME||MV:/wp-admin/admin-ajax.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:09:04 dovecot_login authenticator failed for H=(i9McIpU85) [165.154.254.163]:61086: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 13:10:35 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50137: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:11:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:46528: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:10:06 dovecot_login authenticator failed for H=(L62PB0mE1) [165.154.235.122]:59051: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:10:21 dovecot_login authenticator failed for H=(rQFf5fp) [158.94.211.83]:55145: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:10:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60628: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:10:20 dovecot_login authenticator failed for H=(ADsycN) [165.154.254.163]:57693: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:10:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:11:05 dovecot_login authenticator failed for H=(HH0uCL6z68) [158.94.208.175]:62087: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:11:07 dovecot_login authenticator failed for H=(U7691n) [158.94.211.83]:50199: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.173.213.143
country_id: 1269750
domain: kendek.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:44463.kendek.com||ServerName:kendek.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:14189a8460ca881e9cadae50b654f92e6bd28251||Title:0x3b4911e9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:11:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54837: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:11:17 dovecot_login authenticator failed for H=(JLpi2I) [165.154.254.163]:52262: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.115.75.186
country_id: 1562822
description:
2026-02-02 13:11:21 dovecot_plain authenticator failed for H=(veqkyw1hpph34ndmx0x) [42.115.75.186]:34607: 535 Incorrect authentication data (set_id=nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:11:03 dovecot_login authenticator failed for H=(Gmm9EFR) [165.154.235.122]:51151: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:11:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:11:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:46528: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:11:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:12:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36336: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:12:14 dovecot_login authenticator failed for H=(trypwmis) [158.94.208.175]:52461: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:12:19 dovecot_login authenticator failed for H=(jyZylaxAfV) [165.154.235.122]:58562: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:12:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65479: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:12:14 dovecot_login authenticator failed for H=(tZwXt7g) [165.154.254.163]:63038: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:12:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:12:16 dovecot_login authenticator failed for H=(bPCwrz) [158.94.211.83]:65513: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:12:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:13:17 dovecot_login authenticator failed for H=(AqEkct) [165.154.235.122]:57837: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:13:25 dovecot_login authenticator failed for H=(VvOOyM1R) [158.94.211.83]:64456: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:13:36 dovecot_login authenticator failed for H=(pPAdLFtp) [165.154.235.122]:62147: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.163
country_id: 2750405
description:
2026-02-02 13:13:08 288748 [Warning] Aborted connection 288748 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.163' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:13:12 dovecot_login authenticator failed for H=(aPXurpws) [158.94.208.175]:54476: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:13:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-02-02 13:13:47 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:56907: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-02-02 13:13:57 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [59.144.79.102]:35622: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.77.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85941519633029 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:13:12 dovecot_login authenticator failed for H=(uKMMWAxx) [165.154.254.163]:58292: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.211.83
country_id: 6252001
description:
Feb  2 13:13:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 158.94.211.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:13:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50262: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.223.177.215
country_id: 1814991
description:
2026-02-02 13:13:59 dovecot_login authenticator failed for H=([223.223.177.220]) [223.223.177.215]:58672: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.31
country_id: 1643084
description:
[2026-02-02 13:14:25 +0800] info [cpaneld] 95.135.93.31 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2026-02-02 13:14:07 dovecot_login authenticator failed for H=([49.124.153.35]) [49.124.153.35]:58934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.83.136
country_id: 1269750
description:
2026-02-02 13:14:09 dovecot_login authenticator failed for H=(static.bb.alp.117.216.47.84.bsnl.in) [103.183.83.136]:3119: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-02-02 13:14:21 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:55044: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:14:09 dovecot_login authenticator failed for H=(pAgkS12) [165.154.254.163]:57460: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:14:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60945: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:14:14 dovecot_login authenticator failed for H=(KA1nCTn5iW) [165.154.235.122]:57376: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:14:17 dovecot_login authenticator failed for H=(nj4t2H) [158.94.208.175]:62812: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:14:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56198: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:14:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.83
country_id: 6252001
description:
2026-02-02 13:14:11 dovecot_login authenticator failed for H=(7MZqoAW3A) [158.94.211.83]:57008: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.21.209.27
country_id: 1814991
description:
2026-02-02 13:14:20 dovecot_login authenticator failed for H=([60.21.209.27]) [60.21.209.27]:63056: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:15:06 dovecot_login authenticator failed for H=(hgBaDe) [165.154.254.163]:53692: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:15:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2026-02-02 13:15:38 dovecot_login authenticator failed for H=([36.135.107.57]) [36.135.107.57]:51662: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.131.192
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/technology.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:15:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:15:12 dovecot_login authenticator failed for H=(ekBJ8M) [165.154.235.122]:61351: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-02-02 13:15:22 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:47882: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 13:15:05 +0800] info [cpaneld] 185.204.54.153 - riflnl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user riflnl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:15:24 dovecot_login authenticator failed for H=(0IVCYDKS) [158.94.208.175]:55485: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:15:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63856: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:16:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56584: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 13:16:43 +0800] info [cpaneld] 185.204.54.153 - rammik "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rammik (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2026-02-02 13:16:44 dovecot_login authenticator failed for H=([210.13.99.68]) [210.13.99.66]:2180: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:16:03 dovecot_login authenticator failed for H=(WMK4Lq) [165.154.254.163]:65442: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:16:11 dovecot_login authenticator failed for H=(PnKraFM) [165.154.235.122]:59266: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:16:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:16:58 dovecot_login authenticator failed for H=(96z4Ic17FB) [158.94.208.175]:52904: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2026-02-02 13:17:00 dovecot_login authenticator failed for H=(nhavuivn.com) [210.245.33.154]:45246: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 13:16:13 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:57963: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:16:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59580: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:17:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:17:28 dovecot_login authenticator failed for H=(NWog9G) [158.94.208.175]:53891: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 13:17:38 H=([167.148.167.71]) [167.148.167.71]:57920 F=<Suport@tujusetia.my> rejected RCPT <layhun.yeoh@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:17:57 dovecot_login authenticator failed for H=(gDPuWFHMdt) [165.154.254.163]:52209: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:17:10 dovecot_login authenticator failed for H=(vzmGj5ukX) [165.154.235.122]:64260: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:17:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54422: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:17:19 dovecot_login authenticator failed for H=(FJ0S3aqHZ) [165.154.254.163]:61928: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 13:18:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58403: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:18:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51932: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:18:59 dovecot_login authenticator failed for H=(PFEEj7) [158.94.208.175]:54382: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:18:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49179: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 13:18:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58403: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:18:09 dovecot_login authenticator failed for H=(H3O6Yo6o) [165.154.235.122]:52106: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:18:16 dovecot_login authenticator failed for H=(jfGuLuFC) [165.154.254.163]:55883: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 13:18:04 H=([167.148.167.71]) [167.148.167.71]:59921 F=<Suport@tujusetia.my> rejected RCPT <mazlan@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:18:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:18:16 dovecot_login authenticator failed for H=(bOng955K) [178.16.52.139]:60548: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:19:49 dovecot_login authenticator failed for H=(N8Hmkt4I) [178.16.52.139]:55661: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 13:19:14 H=([167.148.167.71]) [167.148.167.71]:65173 F=<Suport@tujusetia.my> rejected RCPT <ptsawani@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:19:33 dovecot_login authenticator failed for H=(uXJsZZe) [158.94.208.175]:55147: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-02-02 13:19:45 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:57202: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:19:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:19:08 dovecot_login authenticator failed for H=(A55r8wS) [165.154.235.122]:57847: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:19:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:19:15 dovecot_login authenticator failed for H=(ng7nkNZmn) [165.154.254.163]:50293: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-02-02 13:20:47 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:40610: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 13:20:47 H=([167.148.167.71]) [167.148.167.71]:55676 F=<Suport@tujusetia.my> rejected RCPT <syafawatiey@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:20:13 dovecot_login authenticator failed for H=(jqvzeZ) [165.154.254.163]:60417: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:20:17 dovecot_login authenticator failed for H=(Vi8ZBopOF) [178.16.52.139]:58265: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2026-02-02 13:20:27 dovecot_login authenticator failed for H=([111.26.95.253]) [111.26.95.254]:49268: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:20:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48622: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:20:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:20:06 dovecot_login authenticator failed for H=(8HCBZUM) [158.94.208.175]:55950: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-02-02 13:20:07 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net [111.70.32.10]:33728: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:20:08 dovecot_login authenticator failed for H=(dXfo9umMlm) [165.154.235.122]:49493: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 116.204.29.39
country_id: 1814991
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/3-side-seal-bag/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:20:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55008: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:21:06 dovecot_login authenticator failed for H=(X1RQp4w5YL) [165.154.235.122]:53301: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:21:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49358: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:21:10 dovecot_login authenticator failed for H=(YwHiB3C) [158.94.208.175]:60015: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:21:11 dovecot_login authenticator failed for H=(s6eG2WmLC) [165.154.254.163]:54521: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:21:12 dovecot_login authenticator failed for H=(EYyZEeYKd0) [178.16.52.139]:59221: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 13:21:30 H=([167.148.167.71]) [167.148.167.71]:58975 F=<Suport@tujusetia.my> rejected RCPT <zainab@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:21:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:22:08 dovecot_login authenticator failed for H=(9XsWclZ) [165.154.254.163]:64944: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:22:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  2 13:22:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa@astlog.com.my has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:22:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54314: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:22:24 dovecot_login authenticator failed for H=(o2wjSOav) [165.154.235.122]:59036: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:23:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49516: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:22:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:22:04 dovecot_login authenticator failed for H=(Py1h35t8) [165.154.235.122]:52636: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:22:08 dovecot_login authenticator failed for H=(WYHu5SuRp7) [178.16.52.139]:54055: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 13:22:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa@astlog.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:23:09 dovecot_login authenticator failed for H=(A3rWCn67) [158.94.208.175]:57938: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:23:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64425: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:23:02 dovecot_login authenticator failed for H=(QhLdP8N) [165.154.235.122]:50183: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:23:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 178.16.52.51
country_id: 2921044
description:
Feb  2 13:23:46 sv3 pure-ftpd[1824100]: (?@178.16.52.51) [WARNING] Authentication failed for user [jasonkua]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:23:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:23:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.145.38.59
country_id: 3175395
description:
2026-02-02 13:24:01 dovecot_plain authenticator failed for H=(tropoigamo) [150.145.38.59]:58009: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:23:04 dovecot_login authenticator failed for H=(si9bBQzL) [178.16.52.139]:62869: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:23:05 dovecot_login authenticator failed for H=(MZmMy6UW) [165.154.254.163]:58663: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:24:23 dovecot_login authenticator failed for H=(APMr9CGS) [178.16.52.139]:57843: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:24:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 13:25:01 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:58474: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:24:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59167: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:24:40 dovecot_login authenticator failed for H=(FkKgFg) [158.94.208.175]:58024: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:24:03 dovecot_login authenticator failed for H=(KTfWbysccU) [165.154.254.163]:52627: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:24:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2026-02-02 13:24:23 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:35482: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.234.135.54
country_id: 1562822
description:
2026-02-02 13:24:16 dovecot_login authenticator failed for H=(125.234.135.54.hcm.viettel.vn) [125.234.135.54]:36623: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:24:21 dovecot_login authenticator failed for H=(cWb8Mtn) [165.154.235.122]:58404: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:25:42 dovecot_login authenticator failed for H=(QTyffdxiM) [158.94.208.175]:64001: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:25:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52739: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:25:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:25:19 dovecot_login authenticator failed for H=(scsQCr3o) [165.154.254.163]:49841: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:25:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44500: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.70.97
country_id: 3017382
description:
[2026-02-02 13:25:26 +0800] info [cpaneld] 138.124.70.97 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:25:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:25:19 dovecot_login authenticator failed for H=(H7ymIHoaoI) [165.154.235.122]:50962: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:25:21 dovecot_login authenticator failed for H=(b8sHc2BMP) [178.16.52.139]:55865: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-02-02 13:26:23 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:42446: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-02-02 13:26:43 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:56445: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-02-02 13:26:55 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:56356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 13:26:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa@astlog.com.my has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:26:19 dovecot_login authenticator failed for H=(Ew8qHBO) [158.94.208.175]:49644: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:26:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:26:16 dovecot_login authenticator failed for H=(5tbT9bHemL) [165.154.254.163]:59986: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:26:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64151: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:26:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:26:14 dovecot_login authenticator failed for H=(sOCDR964) [178.16.52.139]:61964: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:26:16 dovecot_login authenticator failed for H=(uTBKat) [165.154.235.122]:58630: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-02-02 13:27:06 dovecot_plain authenticator failed for H=(reflebity) [65.20.233.110]:57045: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:27:08 dovecot_login authenticator failed for H=(0OhfXV) [178.16.52.139]:63229: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:27:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:27:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:27:32 dovecot_login authenticator failed for H=(zIhzbRu) [165.154.235.122]:50616: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:27:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38208: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:27:14 dovecot_login authenticator failed for H=(ptdEHAKx3) [165.154.254.163]:53811: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:27:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58865: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:27:13 dovecot_login authenticator failed for H=(7nrTAWMjW) [165.154.235.122]:54202: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:28:01 dovecot_login authenticator failed for H=(XNUgGHT) [158.94.208.175]:51059: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:28:59 dovecot_login authenticator failed for H=(YeGGWaEEz8) [158.94.208.175]:52815: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:28:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55087: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:28:22 dovecot_login authenticator failed for H=(4cutFYViG) [178.16.52.139]:61550: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:28:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:28:11 dovecot_login authenticator failed for H=(VSLQCf) [165.154.235.122]:63841: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:28:12 dovecot_login authenticator failed for H=(FQ9Ax2) [165.154.254.163]:64410: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:29:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:29:09 dovecot_login authenticator failed for H=(UG01g4R5V) [165.154.254.163]:58212: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:29:14 dovecot_login authenticator failed for H=(XxKbFJ) [178.16.52.139]:51585: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:29:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35446: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:29:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65414: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:29:09 dovecot_login authenticator failed for H=(YSCG2XY) [165.154.235.122]:50279: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:29:59 dovecot_login authenticator failed for H=(A8TLQzl509) [158.94.208.175]:55827: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:30:14 dovecot_login authenticator failed for H=(TBpeBfXf) [165.154.235.122]:60466: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:30:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:30:19 dovecot_login authenticator failed for H=(nRjBD77GUN) [178.16.52.139]:57488: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:30:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53680: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:30:06 dovecot_login authenticator failed for H=(6aOgRSGVfc) [165.154.254.163]:52053: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:30:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:30:30 dovecot_login authenticator failed for H=(1RbVrXg9h) [158.94.208.175]:62697: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:31:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:31:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:31:13 dovecot_login authenticator failed for H=(TzcsgQDbX8) [178.16.52.139]:53271: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:31:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64906: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:31:06 dovecot_login authenticator failed for H=(lA6GIK) [165.154.254.163]:62195: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:31:03 dovecot_login authenticator failed for H=(SGotRS7Yn) [158.94.208.175]:56843: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:31:12 dovecot_login authenticator failed for H=(tcZSco) [165.154.235.122]:60816: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:31:31 dovecot_login authenticator failed for H=(DzuxLx) [165.154.235.122]:61085: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:32:11 dovecot_login authenticator failed for H=(8ofHFVsYtR) [178.16.52.139]:65362: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 13:32:22 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:49723: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:32:34 dovecot_login authenticator failed for H=(yd7o3xO) [158.94.208.175]:54363: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:32:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:32:04 dovecot_login authenticator failed for H=(mhL8mdeWq) [165.154.254.163]:55957: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:32:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53368: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:32:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:32:10 dovecot_login authenticator failed for H=(Ot7ixo) [165.154.235.122]:63818: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:32:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58857: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-02-02 13:33:09 dovecot_login authenticator failed for H=(152-237-221-1.user.vtal.net.br) [187.40.215.162]:42172: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-02-02 13:33:17 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:58536: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:33:20 dovecot_login authenticator failed for H=(1yvX3p) [165.154.254.163]:52181: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:33:06 dovecot_login authenticator failed for H=(etr5dfUj1i) [178.16.52.139]:60069: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:33:07 dovecot_login authenticator failed for H=(rqTb7z0j7B) [165.154.235.122]:60900: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:33:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52698: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:33:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:33:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:33:06 dovecot_login authenticator failed for H=(fz2IOTu) [158.94.208.175]:52462: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.138.249
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95541520648540 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:34:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63883: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 13:34:21 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:61755: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:34:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.222.230.86
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:56294.krisfood.com||ServerName:krisfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1fb6734fa39aad93df7f890a941f3cb983fda5c||Title:0x38b80401||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:34:19 dovecot_login authenticator failed for H=(zBCHCh1) [165.154.254.163]:62036: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:34:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57708: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:34:09 dovecot_login authenticator failed for H=(o6MgqFWn) [165.154.235.122]:51820: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:34:14 dovecot_login authenticator failed for H=(1jo4mM) [158.94.208.175]:61578: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:34:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:34:12 dovecot_login authenticator failed for H=(N2Ww7wW) [178.16.52.139]:62341: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:35:09 dovecot_login authenticator failed for H=(YAJTNU7) [165.154.235.122]:64856: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:35:15 dovecot_login authenticator failed for H=(4zexcktwgv) [158.94.208.175]:51392: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:35:55 dovecot_login authenticator failed for H=(m1NPWyX1UG) [165.154.254.163]:61062: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:35:03 dovecot_login authenticator failed for H=(XHjgrr1hn) [178.16.52.139]:61623: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:35:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58455: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:35:17 dovecot_login authenticator failed for H=(bBleU24C) [165.154.254.163]:51854: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:35:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:35:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:36:27 dovecot_login authenticator failed for H=(UaMkejYRzM) [178.16.52.139]:50593: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:36:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33596: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:36:14 dovecot_login authenticator failed for H=(ya4lr0) [165.154.254.163]:64332: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:36:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:36:11 dovecot_login authenticator failed for H=(mKhSri) [158.94.208.175]:61056: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23576: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:36:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52668: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:36:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:36:07 dovecot_login authenticator failed for H=(wbJYYeiO4) [165.154.235.122]:62018: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:37:42 dovecot_login authenticator failed for H=(rQaOBEBE) [178.16.52.139]:57263: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:37:18 dovecot_login authenticator failed for H=(iNHflsS) [158.94.208.175]:56679: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:37:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57939: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 13:37:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:37:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:37:05 dovecot_login authenticator failed for H=(tQbrDo) [165.154.235.122]:63031: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:37:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23576: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:37:12 dovecot_login authenticator failed for H=(LHcJQuDQk) [165.154.254.163]:58562: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 13:38:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:38:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38750: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:38:51 dovecot_login authenticator failed for H=(4n0tRqzekr) [158.94.208.175]:55921: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:38:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:38:10 dovecot_login authenticator failed for H=(zO1XfxPB) [165.154.254.163]:52481: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:38:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52079: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:39:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47123: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:38:04 dovecot_login authenticator failed for H=(jIgAi6FiS4) [165.154.235.122]:57406: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:38:08 dovecot_login authenticator failed for H=(24cNkh7LF) [178.16.52.139]:62121: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:38:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.186.93
country_id: 1562822
description:
2026-02-02 13:39:12 dovecot_login authenticator failed for H=([127.0.0.1]) [113.160.186.93]:47339: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 13:39:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47123: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.179.36
country_id: 2510769
description:
2026-02-02 13:39:15 dovecot_login authenticator failed for H=36.red-80-29-179.dynamicip.rima-tde.net [80.29.179.36]:39741: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 34.229.106.88
country_id: 6252001
domain: mams.manforce.net
description:
IM360 WAF: Possible XSS in arguments||MV:sig1=(\"@authority\" \"signature-agent\");created=1770010753;keyid=\"qdc6-vlwad4yd6yremqpjilim3bxffja_vhgl5qa71e\";alg=\"ed25519\";expires=1770010783;nonce=\"n3lxhvg2vcbyvb3ttgbnlbzjfnnqbrz73dpadk5j0zac8ctrgsy on5nxkzyytlz\";tag=\"web-bot-auth\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:39:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:39:22 dovecot_login authenticator failed for H=(TZVfj1Be8) [165.154.235.122]:61234: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-02-02 13:39:05 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:37651: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:39:08 dovecot_login authenticator failed for H=(4otbQhkL0) [165.154.254.163]:62416: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 13:39:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:39:23 dovecot_login authenticator failed for H=(VlitzQQp) [158.94.208.175]:59302: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.164
country_id: 2661886
description:
2026-02-02 13:39:05 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.164]:49546: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:39:29 dovecot_login authenticator failed for H=(LL8WdbZXXU) [178.16.52.139]:64971: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:39:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62733: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:39:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:40:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59300: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 13:40:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:40:40 dovecot_login authenticator failed for H=(75D6EpBjb) [165.154.235.122]:64511: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:40:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:40:28 dovecot_login authenticator failed for H=(BMNsTgHmP) [178.16.52.139]:58408: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.207
country_id: 2510769
description:
2026-02-02 13:40:40 dovecot_login authenticator failed for H=([127.0.0.1]) [45.136.194.207]:58572: 535 Incorrect authentication data (set_id=adilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.196.178.243
country_id: 3895114
description:
2026-02-02 13:40:49 dovecot_login authenticator failed for H=([127.0.0.1]) [131.196.178.243]:45419: 535 Incorrect authentication data (set_id=adilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:40:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:40:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46608: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:40:07 dovecot_login authenticator failed for H=(GylfHgvO) [165.154.254.163]:56369: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:40:30 dovecot_login authenticator failed for H=(ulXPs7VY) [158.94.208.175]:60505: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:40:20 dovecot_login authenticator failed for H=(4n4viwzg) [165.154.235.122]:54882: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.137.85.9
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/CachedObjectStorage/SQLite.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:41:06 dovecot_login authenticator failed for H=(inSA22) [165.154.254.163]:50075: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:41:19 dovecot_login authenticator failed for H=(2qZkyQT) [165.154.235.122]:63010: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 13:41:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:41:03 dovecot_login authenticator failed for H=(F65NQ0c) [158.94.208.175]:51160: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.57.170.117
country_id: 3175395
description:
[2026-02-02 13:41:06 +0800] info [webmaild] 2.57.170.117 - jasonkua@printspecsolution.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:41:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 5.1.4.54
country_id: 690791
domain: tst-ma.com
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:<a href=\"https://bestcasinobangladesh.online/\">bestcasinobglkPi</a>||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:41:31 dovecot_login authenticator failed for H=(4MJtb5XD) [178.16.52.139]:55162: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:41:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53741: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 13:42:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:42:07 dovecot_login authenticator failed for H=(SJmUjUqaAi) [158.94.208.175]:58839: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:42:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:42:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64735: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:42:18 dovecot_login authenticator failed for H=(M6XdSldh) [165.154.235.122]:58572: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:42:05 dovecot_login authenticator failed for H=(fMZnE0) [165.154.254.163]:60202: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:42:24 dovecot_login authenticator failed for H=(IEYh90u) [178.16.52.139]:62252: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-02-02 13:42:25 dovecot_login authenticator failed for H=([182.95.123.46]) [182.95.123.46]:36920: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.150.147
country_id: 2661886
description:
2026-02-02 13:42:34 dovecot_login authenticator failed for H=h188-122-150-147.cust.bredband2.com [188.122.150.147]:43294: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:42:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:43:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:43:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:43:12 dovecot_login authenticator failed for H=(AAQYFFTuOx) [158.94.208.175]:54928: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-02-02 13:43:16 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:40712: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:43:18 dovecot_login authenticator failed for H=(8jfjDTYDID) [165.154.235.122]:64111: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:43:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:43:43 dovecot_login authenticator failed for H=(VaJKoy) [178.16.52.139]:55315: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:43:03 dovecot_login authenticator failed for H=(BFLcSkbH) [165.154.254.163]:54088: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:43:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63695: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
country_id: 1814991
description:
2026-02-02 13:43:32 dovecot_login authenticator failed for H=([117.176.204.214]) [117.176.204.214]:47342: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:44:09 dovecot_login authenticator failed for H=(scFWAZc) [178.16.52.139]:62652: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:44:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:44:17 dovecot_login authenticator failed for H=(7sDROYpr44) [165.154.235.122]:54934: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:44:21 dovecot_login authenticator failed for H=(24x0aUtln) [165.154.254.163]:51434: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:44:40 dovecot_login authenticator failed for H=(qJ5CV75) [165.154.254.163]:54750: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:44:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:44:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58614: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:44:09 dovecot_login authenticator failed for H=(DlDTbm3C) [158.94.208.175]:57393: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:45:41 dovecot_login authenticator failed for H=(62Oo53K4) [158.94.208.175]:63843: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:45:18 dovecot_login authenticator failed for H=(vowQ2StJg) [165.154.254.163]:61444: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:45:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64142: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-02-02 13:45:44 289889 [Warning] Aborted connection 289889 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:45:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:45:15 dovecot_login authenticator failed for H=(KHLeCjs8f) [165.154.235.122]:55336: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:45:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37366: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:45:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:45:49 dovecot_login authenticator failed for H=(tHEz4Zjf) [178.16.52.139]:54587: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-02-02 13:46:55 1vmmly-00000007jan-0E1W <= <> H=165.193.32.34.bc.googleusercontent.com ([10.88.0.4]) [34.32.193.165]:33010 P=esmtp S=5845 T="Authentication Error" for wmchan@nexuscollection.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 13:46:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58433: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:46:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:46:11 dovecot_login authenticator failed for H=(iKM4Vmxv) [158.94.208.175]:54823: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:46:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:46:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58645: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:46:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:46:13 dovecot_login authenticator failed for H=(iUwGb7nqJk) [165.154.235.122]:59316: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:46:15 dovecot_login authenticator failed for H=(GXEq0ufYT) [178.16.52.139]:53430: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:46:16 dovecot_login authenticator failed for H=(nGARQEx) [165.154.254.163]:55067: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:47:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:47:14 dovecot_login authenticator failed for H=(zU7OjutwnH) [165.154.254.163]:65361: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:47:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53840: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:47:47 dovecot_login authenticator failed for H=(UvzHbZ) [158.94.208.175]:63280: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:47:04 dovecot_login authenticator failed for H=(azZ6Ge) [178.16.52.139]:51380: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:47:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.45.25
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:47:10 dovecot_login authenticator failed for H=(1KAo1me9Tp) [165.154.235.122]:55126: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:47:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34208: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:48:20 dovecot_login authenticator failed for H=(ck5mgRIxp0) [158.94.208.175]:64552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:48:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:48:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:48:15 dovecot_login authenticator failed for H=(Tj9T4G7) [165.154.254.163]:59647: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:48:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63444: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:48:28 dovecot_login authenticator failed for H=(1UpNslz) [178.16.52.139]:55092: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 13:48:31 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:54669: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:48:10 dovecot_login authenticator failed for H=(YBrwQxw) [165.154.235.122]:53786: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.214.204.226
country_id: 298795
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/odbc.ini||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:49:32 dovecot_login authenticator failed for H=(ctFR2Z9hBB) [178.16.52.139]:56695: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:49:14 dovecot_login authenticator failed for H=(5IC72tEDj) [165.154.254.163]:53839: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:49:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57912: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:49:21 dovecot_login authenticator failed for H=(Z7BkqC3EH) [158.94.208.175]:50185: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:49:27 dovecot_login authenticator failed for H=(wbSQLh) [165.154.235.122]:49485: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:49:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59532: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:49:08 dovecot_login authenticator failed for H=(Gk6e4Q6w) [165.154.235.122]:53888: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:49:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:50:06 dovecot_login authenticator failed for H=(T33JGgZzQ) [165.154.235.122]:63301: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:50:11 dovecot_login authenticator failed for H=(yOIFHUR37) [165.154.254.163]:64305: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-02-02 13:50:17 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:52906: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-02-02 13:50:26 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:51771: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-02-02 13:50:37 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:60576: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-02 13:50:06 290061 [Warning] Aborted connection 290061 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:50:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53642: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.52.9.162
country_id: 1814991
description:
2026-02-02 13:50:14 dovecot_login authenticator failed for H=([116.52.9.162]) [116.52.9.162]:60467: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:50:21 dovecot_login authenticator failed for H=(nv7bvU7Z2z) [158.94.208.175]:50343: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:50:26 dovecot_login authenticator failed for H=(mbvs9XI5UH) [178.16.52.139]:63142: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.28.36
country_id: 1814991
description:
2026-02-02 13:50:30 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.28.36]:36073: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.216.33.31
country_id: 1269750
description:
2026-02-02 13:50:51 dovecot_login authenticator failed for H=([117.216.33.31]) [117.216.33.31]:57396: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-02-02 13:50:53 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (protax) [174.161.27.82]:39519: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:50:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.158.219
country_id: 1814991
description:
2026-02-02 13:50:20 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.158.219]:36044: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 92.23.147.37
country_id: 2635167
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/sw-engine/pool.d/default.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:51:05 dovecot_login authenticator failed for H=(QI23n39nY) [165.154.235.122]:56376: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:51:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:51:09 dovecot_login authenticator failed for H=(Et3C5Os0) [165.154.254.163]:58453: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:51:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64523: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:51:25 dovecot_login authenticator failed for H=(kAkoRlUBAb) [158.94.208.175]:60314: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:51:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:32928: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:52:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:51:18 dovecot_login authenticator failed for H=(1sFmln9ML) [178.16.52.139]:50897: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:52:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:52:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:52:25 dovecot_login authenticator failed for H=(nO9jFh) [178.16.52.139]:61908: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:52:07 dovecot_login authenticator failed for H=(UkuhWwb8n4) [165.154.254.163]:52530: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:52:10 dovecot_login authenticator failed for H=(HeinL3BG75) [158.94.208.175]:59768: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:52:14 dovecot_login authenticator failed for H=(fPpAcXM) [137.220.199.220]:52696: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:52:02 dovecot_login authenticator failed for H=(x2URMd6F3) [165.154.235.122]:63521: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:52:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61167: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 13:52:05 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (suboyst) [87.103.126.54]:14138: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:53:10 dovecot_login authenticator failed for H=(PCc19HGG6n) [158.94.208.175]:50385: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 13:53:18 H=([141.98.10.106]) [141.98.10.106]:53857 F=<mselhime@drake-scruggs.com> rejected RCPT <info@cordage.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:53:24 dovecot_login authenticator failed for H=(mdflon) [165.154.254.163]:53511: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:53:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63956: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:53:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:53:08 dovecot_login authenticator failed for H=(xcnOyGm8Ek) [137.220.199.220]:53538: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:53:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:53:21 dovecot_login authenticator failed for H=(nDDHXAJ0) [178.16.52.139]:61064: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:53:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58460: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:53:02 dovecot_login authenticator failed for H=(W7eOAWLqV) [165.154.235.122]:54589: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:53:05 dovecot_login authenticator failed for H=(7M8r4ZqN) [165.154.254.163]:50061: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 13:53:55 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:49983: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-02-02 13:54:47 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (pecity) [24.91.103.202]:48762: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:54:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56886: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:54:10 dovecot_login authenticator failed for H=(vwV1Sair0D) [137.220.199.220]:54931: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:54:15 dovecot_login authenticator failed for H=(8iBd9T0mVx) [158.94.208.175]:62151: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:54:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:54:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:54:02 dovecot_login authenticator failed for H=(3YH4PUH61) [165.154.254.163]:59416: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:54:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:54:14 dovecot_login authenticator failed for H=(HUZChQ0) [178.16.52.139]:56886: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:54:20 dovecot_login authenticator failed for H=(kXcEj7XO) [165.154.235.122]:52143: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-02-02 13:55:23 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (gennuncity) [174.166.153.20]:45342: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:55:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54914: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:55:08 dovecot_login authenticator failed for H=(GdUAZxvgI) [178.16.52.139]:54450: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:55:18 dovecot_login authenticator failed for H=(AyDWJX) [165.154.254.163]:56035: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-02-02 13:55:20 dovecot_plain authenticator failed for H=(sutarkinds) [24.104.225.201]:56907: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:55:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62240: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-02-02 13:55:51 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (nathy) [73.188.252.208]:41666: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:55:04 dovecot_login authenticator failed for H=(hMDS9M59) [137.220.199.220]:55849: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:55:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:55:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-02 13:55:37 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (devang) [73.196.144.25]:57862: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:55:17 dovecot_login authenticator failed for H=(o7uKfCHG7) [165.154.235.122]:58583: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:55:23 dovecot_login authenticator failed for H=(WMf6HVJprc) [158.94.208.175]:63044: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:56:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:56:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-02-02 13:56:59 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:51437: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:56:16 dovecot_login authenticator failed for H=(oMsQULwuu) [137.220.199.220]:57234: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:56:17 dovecot_login authenticator failed for H=(ECM9BG5F) [165.154.254.163]:51668: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:56:19 dovecot_login authenticator failed for H=(z5xcjGDiM) [137.220.199.220]:57677: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:56:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57266: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:56:02 dovecot_login authenticator failed for H=(3EDNweKO) [158.94.208.175]:63558: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:56:15 dovecot_login authenticator failed for H=(QmwI2zB) [165.154.235.122]:57933: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 13:56:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:56:19 dovecot_login authenticator failed for H=(8j98gHHSy) [178.16.52.139]:53630: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.201.121.51
country_id: 2921044
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/wp-json/wp/v2/posts HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:57:15 dovecot_login authenticator failed for H=(0tuo1KZ) [165.154.254.163]:62206: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 13:57:53 H=([167.148.167.71]) [167.148.167.71]:53256 F=<Suport@hmz.com.my> rejected RCPT <account@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 13:57:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46170: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:57:07 dovecot_login authenticator failed for H=(QCyhSPy) [137.220.199.220]:58770: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-02-02 13:57:09 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET /cpsess2026891781/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=38942&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:57:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:57:14 dovecot_login authenticator failed for H=(UeeaW3wc4) [165.154.235.122]:54794: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-02-02 13:57:30 dovecot_login authenticator failed for H=(41.215.125.250.accesskenya.com) [41.215.125.250]:58774: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 13:57:33 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:57:10 dovecot_login authenticator failed for H=(DUjvr5CH) [178.16.52.139]:57289: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:57:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52339: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.180.137.116
country_id: 3469034
domain: langkawiconstructions.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97866.langkawiconstructions.com||ServerName:langkawiconstructions.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81da8cb6d5a5d801afe73a3931bd9d20eb673c03||Title:0xf3a4d920||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:57:40 dovecot_login authenticator failed for H=(9mRBrWIL) [158.94.208.175]:57922: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:58:18 dovecot_login authenticator failed for H=(KxbVntP3e) [137.220.199.220]:59844: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:58:42 dovecot_login authenticator failed for H=(2DWEAr) [137.220.199.220]:60575: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:58:14 dovecot_login authenticator failed for H=(w3txK9O) [165.154.235.122]:58577: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:58:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:58:12 dovecot_login authenticator failed for H=(4SSQsC) [165.154.254.163]:57680: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:58:16 dovecot_login authenticator failed for H=(7s6yXi) [158.94.208.175]:55397: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:58:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63866: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:58:06 dovecot_login authenticator failed for H=(8FcDko1oW) [178.16.52.139]:55408: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 13:58:57 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 13:59:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-02-02 13:59:27 dovecot_login authenticator failed for H=([152.52.238.54]) [27.123.92.202]:48156: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 13:59:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 13:59:07 dovecot_login authenticator failed for H=(5kW0F8u) [165.154.235.122]:52565: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 13:59:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58518: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:00:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56156: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 13:59:11 dovecot_login authenticator failed for H=(9hgQQxR) [165.154.254.163]:54170: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 13:59:21 dovecot_login authenticator failed for H=(1f9zANIe9) [158.94.208.175]:62833: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 13:59:27 dovecot_login authenticator failed for H=(lXAzPKhaF) [178.16.52.139]:61517: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 13:59:02 dovecot_login authenticator failed for H=(veusmR) [137.220.199.220]:60781: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2026-02-02 13:59:17 dovecot_login authenticator failed for H=([49.124.152.172]) [49.124.152.172]:42186: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 13:59:50 +0800] info [cpaneld] 185.204.54.153 - labidk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user labidk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:00:10 dovecot_login authenticator failed for H=(yqizwQ) [165.154.254.163]:50018: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:00:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:00:19 dovecot_login authenticator failed for H=(vOsOefof) [165.154.235.122]:61556: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:00:16 dovecot_login authenticator failed for H=(zZeOUP) [178.16.52.139]:63488: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-02-02 14:00:21 dovecot_plain authenticator failed for H=(implomidly) [65.20.205.197]:44272: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.111.37.192
country_id: 6252001
description:
2026-02-02 14:00:27 dovecot_login authenticator failed for H=wsip-68-111-37-192.sb.sd.cox.net ([127.0.0.1]) [68.111.37.192]:43746: 535 Incorrect authentication data (set_id=alexsantiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:00:14 dovecot_login authenticator failed for H=(j7SHsmZkf) [137.220.199.220]:62171: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-02-02 14:00:14 dovecot_plain authenticator failed for H=(unize) [24.104.225.201]:55024: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:01:00 dovecot_login authenticator failed for H=(CMI5sn) [158.94.208.175]:56773: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:00:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54393: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.111.37.232
country_id: 6252001
description:
2026-02-02 14:00:35 dovecot_login authenticator failed for H=wsip-68-111-37-232.sb.sd.cox.net ([127.0.0.1]) [68.111.37.232]:43814: 535 Incorrect authentication data (set_id=alexsantiago)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:01:23 dovecot_login authenticator failed for H=(isIDhXI) [137.220.199.220]:63756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-02-02 14:01:37 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:47578: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:01:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49381: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:01:10 dovecot_login authenticator failed for H=(rfcogcQ8) [165.154.254.163]:62422: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:01:13 dovecot_login authenticator failed for H=(qs4vecp) [178.16.52.139]:64376: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:01:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:01:07 dovecot_login authenticator failed for H=(3IUNBEWpO) [137.220.199.220]:63248: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:01:18 dovecot_login authenticator failed for H=(UlPCTuxQUF) [165.154.235.122]:56678: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-02-02 14:01:26 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:46160: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:02:16 dovecot_login authenticator failed for H=(hAaLAUg) [165.154.235.122]:57435: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:02:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:02:04 dovecot_login authenticator failed for H=(T6YyKvV) [137.220.199.220]:64469: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:02:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41786: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:02:08 dovecot_login authenticator failed for H=(iHyeeBU) [165.154.254.163]:57358: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:02:13 dovecot_login authenticator failed for H=(2gYnlO) [178.16.52.139]:54927: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:02:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-02-02 14:02:46 dovecot_plain authenticator failed for H=(alike) [50.187.152.61]:57526: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:02:03 dovecot_login authenticator failed for H=(gqDzcLDKX) [158.94.208.175]:61283: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:02:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60881: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:03:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:03:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:03:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54082: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:03:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:03:16 dovecot_login authenticator failed for H=(rPWXe1QpN) [165.154.235.122]:55421: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:03:07 dovecot_login authenticator failed for H=(qViQ0ZedK) [165.154.254.163]:52595: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:03:14 dovecot_login authenticator failed for H=(U50YZFrfz2) [178.16.52.139]:61800: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:03:04 dovecot_login authenticator failed for H=(OwipHdeep) [158.94.208.175]:50436: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:03:09 dovecot_login authenticator failed for H=(KHIYMXfXF) [137.220.199.220]:65533: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:04:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45830: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:04:28 dovecot_login authenticator failed for H=(emfAfeFcp) [137.220.199.220]:50794: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23603: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:04:14 dovecot_login authenticator failed for H=(nJVIv3) [165.154.235.122]:59958: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:04:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:04:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50233: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:04:23 dovecot_login authenticator failed for H=(SN0RU4Zedq) [158.94.208.175]:57343: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:04:10 dovecot_login authenticator failed for H=(dRED9TcwR) [137.220.199.220]:50448: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:04:09 dovecot_login authenticator failed for H=(fObmg2tf) [178.16.52.139]:58494: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:04:04 dovecot_login authenticator failed for H=(XZDBK5cqN) [165.154.254.163]:64381: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:04:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-02-02 14:04:37 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (torpe) [24.23.125.83]:59624: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:04:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:05:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23603: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:05:13 dovecot_login authenticator failed for H=(7QRiDsf) [165.154.235.122]:53295: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:05:27 dovecot_login authenticator failed for H=(aaaMoU) [158.94.208.175]:65194: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:05:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:05:22 dovecot_login authenticator failed for H=(Bf1M2lmU) [165.154.254.163]:63154: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:05:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61306: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:05:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 14:05:26 H=([167.148.167.71]) [167.148.167.71]:50372 F=<Suport@nexuscollection.com> rejected RCPT <admin@nexuscollection.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:05:04 dovecot_login authenticator failed for H=(JRgL4Dav) [178.16.52.139]:49870: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:05:04 dovecot_login authenticator failed for H=(RWnhnJ) [137.220.199.220]:51489: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:06:03 dovecot_login authenticator failed for H=(yLBnUVF) [178.16.52.139]:51131: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-02 14:06:04 dovecot_login authenticator failed for H=(W9nrg7) [137.220.199.220]:52947: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:06:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:06:47 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47149: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:06:04 dovecot_login authenticator failed for H=(wkUh7Yo) [158.94.208.175]:58483: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.90.10
country_id: 1814991
description:
2026-02-02 14:06:11 dovecot_login authenticator failed for H=([1.26.90.10]) [1.26.90.10]:17480: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-02 14:06:14 291199 [Warning] Aborted connection 291199 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:06:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:06:11 dovecot_login authenticator failed for H=(TOOrLUF79p) [165.154.235.122]:55830: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:06:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56272: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:06:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50182: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:06:19 dovecot_login authenticator failed for H=(vHRXBPP) [92.118.39.145]:62052: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-02-02 14:06:20 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:55678: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:06:21 dovecot_login authenticator failed for H=(Nu6Lzwy) [165.154.254.163]:58498: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:07:10 dovecot_login authenticator failed for H=(7Q8QpDr) [92.118.39.145]:63450: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:07:11 dovecot_login authenticator failed for H=(9uMw3KMBm) [165.154.235.122]:59865: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 14:07:11 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (zonemism) [87.103.126.54]:65234: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 14:07:24 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:52828: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:07:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47150: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:07:19 dovecot_login authenticator failed for H=(8tm6qw71nz) [165.154.254.163]:53554: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:07:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:07:20 dovecot_login authenticator failed for H=(9rHdqk) [178.16.52.139]:54826: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:07:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61558: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:07:48 dovecot_login authenticator failed for H=(TMLIDuo) [158.94.208.175]:62171: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:08:18 dovecot_login authenticator failed for H=(xTDVisu) [165.154.254.163]:65000: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:08:19 dovecot_login authenticator failed for H=(8nnrKL) [92.118.39.145]:50281: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 14:08:33 dovecot_plain authenticator failed for H=(exuve) [154.144.243.93]:49458: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:08:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:08:09 dovecot_login authenticator failed for H=(l7RuwOh3) [165.154.235.122]:50028: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:08:28 dovecot_login authenticator failed for H=(3cexyB) [165.154.235.122]:53785: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:08:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33638: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:08:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53530: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:08:09 dovecot_login authenticator failed for H=(oTPlAkOv) [178.16.52.139]:52978: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:08:22 dovecot_login authenticator failed for H=(nBfemj) [158.94.208.175]:62855: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:09:51 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50703: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:09:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:09:06 dovecot_login authenticator failed for H=(7cl1ja01) [92.118.39.145]:52570: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:09:08 dovecot_login authenticator failed for H=(QtPrP9) [165.154.235.122]:55409: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:09:10 dovecot_login authenticator failed for H=(xqk1p57) [178.16.52.139]:56524: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:09:18 dovecot_login authenticator failed for H=(Ow9Ym2qU) [165.154.254.163]:60107: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:09:28 dovecot_login authenticator failed for H=(jjVryIiJ) [158.94.208.175]:60370: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:09:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:10:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50703: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 14:10:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account png-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-02-02 14:10:04 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [27.72.46.152]:51249: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:10:07 dovecot_login authenticator failed for H=(LDyzMsTgFI) [165.154.235.122]:56414: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:10:16 dovecot_login authenticator failed for H=(9bgbo1n) [165.154.254.163]:55159: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:10:10 dovecot_login authenticator failed for H=(Y7JZOnOnJd) [178.16.52.139]:56230: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:10:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2026-02-02 14:10:17 dovecot_login authenticator failed for H=([173.245.250.16]) [173.245.250.16]:41258: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:10:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:10:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.12
country_id: 2750405
description:
Feb  2 14:10:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account png-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.12)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:10:13 dovecot_login authenticator failed for H=(dgs31X) [92.118.39.145]:55243: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:10:29 dovecot_login authenticator failed for H=(LKArMfXl) [158.94.208.175]:59079: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:10:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44174: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:11:06 dovecot_login authenticator failed for H=(6zeo19cDpR) [165.154.235.122]:55541: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:11:24 dovecot_login authenticator failed for H=(r2vRwf) [92.118.39.145]:58389: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:11:33 dovecot_login authenticator failed for H=(zV3CE2eDt) [158.94.208.175]:55254: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:11:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:11:14 dovecot_login authenticator failed for H=(8pj2IxLaNz) [165.154.254.163]:49908: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:11:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:11:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:11:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63136: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:11:10 dovecot_login authenticator failed for H=(gxfqWstko) [178.16.52.139]:54724: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:12:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:12:05 dovecot_login authenticator failed for H=(ZzpVT0Hl) [165.154.235.122]:58339: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:12:09 dovecot_login authenticator failed for H=(GdmGP374) [158.94.208.175]:65361: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.5.32
country_id: 1562822
description:
2026-02-02 14:12:57 H=([160.250.5.32]) [160.250.5.32]:57550 F=<leonqdop08@leon-logistics.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 160.250.5.32 is not allowed to send mail from leon-logistics.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:12:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:12:12 dovecot_login authenticator failed for H=(krliXFi84) [165.154.254.163]:61128: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:12:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:12:14 dovecot_login authenticator failed for H=(u2W4dxFr) [178.16.52.139]:60854: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:12:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60401: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:12:36 dovecot_login authenticator failed for H=(WECyvNhDO) [178.16.52.139]:60679: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:12:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44270: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:12:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:12:11 dovecot_login authenticator failed for H=(SVfD8Kmdr2) [92.118.39.145]:60550: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 14:13:26 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:52348: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 14:14:00 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:49432: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:13:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:13:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-02-02 14:13:20 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:13:10 dovecot_login authenticator failed for H=(d1rt07iFS) [165.154.254.163]:55834: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:13:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 14:14:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58456: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:13:01 dovecot_login authenticator failed for H=(cNaRuKWSe) [178.16.52.139]:60831: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:13:04 dovecot_login authenticator failed for H=(otHMri) [165.154.235.122]:59430: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:13:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:13:16 dovecot_login authenticator failed for H=(z4N8YHGtB) [158.94.208.175]:60904: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:13:18 dovecot_login authenticator failed for H=(XCw15x) [92.118.39.145]:63766: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:14:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59964: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 14:14:53 H=([167.148.167.71]) [167.148.167.71]:57056 F=<Suport@nexuscollection.com> rejected RCPT <alex@nexuscollection.com>: smtp auth required


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 14:14:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account png-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:14:10 dovecot_login authenticator failed for H=(whrDmPNGv) [165.154.254.163]:51023: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:14:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59923: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:14:20 dovecot_login authenticator failed for H=(Q1O9gkMl) [158.94.208.175]:55135: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:14:21 dovecot_login authenticator failed for H=(szzbUIg) [165.154.235.122]:55357: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 14:14:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58456: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:14:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:14:12 dovecot_login authenticator failed for H=(QZ3V5n) [178.16.52.139]:56312: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:14:15 dovecot_login authenticator failed for H=(fYe3i4teXr) [92.118.39.145]:50374: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:15:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55054: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:15:12 dovecot_login authenticator failed for H=(TVQAEOHup) [178.16.52.139]:60230: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:15:24 dovecot_login authenticator failed for H=(uKKie9egkK) [92.118.39.145]:53228: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:15:08 dovecot_login authenticator failed for H=(FGP1uWjo) [165.154.254.163]:62141: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 14:15:35 +0800] info [cpaneld] 185.204.54.153 - rofnam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rofnam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:15:46 dovecot_login authenticator failed for H=(HWVOy1D) [158.94.208.175]:55615: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.163
country_id: 2750405
description:
2026-02-02 14:15:51 291635 [Warning] Aborted connection 291635 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.163' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:15:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:15:20 dovecot_login authenticator failed for H=(CDXzntvtV) [165.154.235.122]:54680: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:16:05 dovecot_login authenticator failed for H=(PqemPZTt) [165.154.254.163]:57130: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-02-02 14:16:05 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (cothrip) [73.53.254.168]:50768: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:16:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:16:18 dovecot_login authenticator failed for H=(VJDIkuxR) [165.154.235.122]:63642: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:16:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49952: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:16:09 dovecot_login authenticator failed for H=(YchsyWj) [92.118.39.145]:55195: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:16:17 dovecot_login authenticator failed for H=(7YhwHJCoK) [158.94.208.175]:60034: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:16:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50333: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:16:38 dovecot_login authenticator failed for H=(XSuIy03) [165.154.235.122]:62502: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-02-02 14:17:14 +0800] info [webmaild] 180.75.72.60 - salesadmin@smartcable.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:17:18 dovecot_login authenticator failed for H=(R2eTgkgk) [165.154.235.122]:54580: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-02-02 14:17:48 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (quillmeted) [67.172.54.29]:33496: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:17:02 dovecot_login authenticator failed for H=(j7mxW6o) [165.154.254.163]:52003: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:17:12 dovecot_login authenticator failed for H=(jOtsQK) [178.16.52.139]:53774: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:17:19 dovecot_login authenticator failed for H=(mHtYtjqxlj) [92.118.39.145]:58258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:17:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:17:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63461: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:17:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:17:18 dovecot_login authenticator failed for H=(WyLiEa) [158.94.208.175]:52723: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:18:04 dovecot_login authenticator failed for H=(7GkKIagy) [92.118.39.145]:60673: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:18:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:18:16 dovecot_login authenticator failed for H=(qbzPPvZWb) [165.154.235.122]:49555: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:18:19 dovecot_login authenticator failed for H=(blBSzKchBa) [165.154.254.163]:50855: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:18:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:18:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:18:06 dovecot_login authenticator failed for H=(nirGfPw) [178.16.52.139]:56905: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.243.99
country_id: 3017382
description:
2026-02-02 14:18:37 dovecot_plain authenticator failed for H=ip99.ip-5-196-243.eu [5.196.243.99]:53952: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:18:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63792: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:19:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:19:17 dovecot_login authenticator failed for H=(WP1bRf) [165.154.254.163]:62842: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:19:20 dovecot_login authenticator failed for H=(C7RzkJNWcO) [158.94.208.175]:51761: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-02-02 14:19:59 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (jadrundsm) [68.40.189.43]:42548: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:19:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41094: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:19:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:19:10 dovecot_login authenticator failed for H=(NpFdgN) [178.16.52.139]:59576: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:19:12 dovecot_login authenticator failed for H=(UHLuzrWX) [92.118.39.145]:64018: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2026-02-02 14:19:45 dovecot_login authenticator failed for H=([49.124.153.8]) [49.124.153.8]:43182: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2026-02-02 14:19:55 dovecot_login authenticator failed for H=([121.73.163.186]) [121.73.163.186]:54614: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.243.99
country_id: 3017382
description:
2026-02-02 14:19:06 dovecot_plain authenticator failed for H=ip99.ip-5-196-243.eu [5.196.243.99]:54719: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:19:15 dovecot_login authenticator failed for H=(ptKmq4iuD) [165.154.235.122]:63136: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.49.247
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=312662 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:19:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53129: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-02-02 14:19:40 +0800] info [webmaild] 180.75.72.60 - salesadmin@smartcable.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:20:19 dovecot_login authenticator failed for H=(BO4c3t) [92.118.39.145]:50531: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:20:23 dovecot_login authenticator failed for H=(GIM6lU0VXo) [158.94.208.175]:54322: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.41.84
country_id: 6252001
description:
2026-02-02 14:20:53 dovecot_login authenticator failed for H=([127.0.0.1]) [216.132.41.84]:34877: 535 Incorrect authentication data (set_id=rina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:20:13 dovecot_login authenticator failed for H=(fw3jEuDW) [165.154.235.122]:59535: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:20:15 dovecot_login authenticator failed for H=(xTRCby) [165.154.254.163]:58072: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:20:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:20:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64745: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:20:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.106
country_id: 2661886
description:
2026-02-02 14:20:46 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.106]:54218: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:20:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.39.227.34
country_id: 1861060
description:
2026-02-02 14:20:45 dovecot_login authenticator failed for H=p430035-obmd01.tokyo.ocn.ne.jp [60.39.227.34]:52464: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:20:53 dovecot_login authenticator failed for H=(DKrdwF) [165.154.254.163]:65313: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:21:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:21:04 dovecot_login authenticator failed for H=(5AExU9t) [92.118.39.145]:52783: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:21:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:21:13 dovecot_login authenticator failed for H=(9uJY4iv) [165.154.254.163]:52496: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:21:24 dovecot_login authenticator failed for H=(ZkpbjH) [158.94.208.175]:58135: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:21:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59375: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:21:34 dovecot_login authenticator failed for H=(rgtyn04pf) [178.16.52.139]:59068: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-02-02 14:21:08 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:58234: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-02-02 14:21:13 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:42556: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:21:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58820: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.63.7.250
country_id: 2921044
description:
2026-02-02 14:21:21 dovecot_login authenticator failed for H=p5b3f07fa.dip0.t-ipconnect.de [91.63.7.250]:60856: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 140.84.179.128
country_id: 3996063
description:
Feb  2 14:21:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(140.84.179.128)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:21:11 dovecot_login authenticator failed for H=(HY8bFuT) [165.154.235.122]:56744: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-02-02 14:21:23 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:45476: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:22:09 dovecot_login authenticator failed for H=(oUrGLTE) [165.154.235.122]:50033: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:22:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:22:11 dovecot_login authenticator failed for H=(6iPQEP) [165.154.254.163]:63901: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:22:25 dovecot_login authenticator failed for H=(ucAa1s) [178.16.52.139]:51387: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:22:28 dovecot_login authenticator failed for H=(42wcvu8pss) [158.94.208.175]:57780: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:22:04 dovecot_login authenticator failed for H=(WOBVT22bO) [92.118.39.145]:55676: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:22:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64500: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-02-02 14:22:33 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (dishcubles) [71.235.225.181]:34578: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:23:09 dovecot_login authenticator failed for H=(eAoMp5) [165.154.235.122]:59874: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:23:11 dovecot_login authenticator failed for H=(Zg3qEU) [165.154.254.163]:59894: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:23:12 dovecot_login authenticator failed for H=(Gqwr34KDVc) [92.118.39.145]:58169: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:23:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61785: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:23:18 dovecot_login authenticator failed for H=(QFDICR) [178.16.52.139]:62343: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:23:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48964: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:23:03 dovecot_login authenticator failed for H=(Rtk4RV1G5) [158.94.208.175]:50696: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:23:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:24:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57136: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:24:09 dovecot_login authenticator failed for H=(KtNEFOq) [165.154.254.163]:55255: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:24:20 dovecot_login authenticator failed for H=(WIQi8rx7n) [92.118.39.145]:60847: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:24:06 dovecot_login authenticator failed for H=(aw49ApWU) [165.154.235.122]:49219: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:24:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:24:40 dovecot_login authenticator failed for H=(jSTQNN4s) [158.94.208.175]:53206: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:24:41 dovecot_login authenticator failed for H=(fnHFAsxD) [178.16.52.139]:57483: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:25:10 dovecot_login authenticator failed for H=(wr5UWuy) [178.16.52.139]:62367: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:25:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51630: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:25:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:25:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52846: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:25:03 dovecot_login authenticator failed for H=(FO0i9b) [165.154.235.122]:58866: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:25:06 dovecot_login authenticator failed for H=(AOm4xg87pm) [165.154.254.163]:50305: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 14:25:14 dovecot_login authenticator failed for H=(GYLuvjOijV) [158.94.208.110]:54655: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.5.32
country_id: 1562822
description:
2026-02-02 14:25:52 H=([160.250.5.32]) [160.250.5.32]:56614 F=<leonqdop08@leon-logistics.com> rejected RCPT <inquiries@ktlog.com.my>: SPF: 160.250.5.32 is not allowed to send mail from leon-logistics.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:25:06 dovecot_login authenticator failed for H=(MpIDaPDKk) [92.118.39.145]:62906: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:25:12 dovecot_login authenticator failed for H=(VNPsOHolgh) [158.94.208.175]:62186: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:25:22 dovecot_login authenticator failed for H=(XA2PqyQ) [165.154.235.122]:51856: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:25:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:26:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:26:20 dovecot_login authenticator failed for H=(ptCkWL) [165.154.235.122]:55578: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:26:16 dovecot_login authenticator failed for H=(45kvxeQW) [92.118.39.145]:49508: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 14:26:03 dovecot_login authenticator failed for H=(mY9Hfzb) [158.94.208.110]:62677: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:26:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63415: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:26:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:26:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:26:04 dovecot_login authenticator failed for H=(J5UNe3) [165.154.254.163]:61817: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 14:26:05 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:51599: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:26:09 dovecot_login authenticator failed for H=(MFDDwKTRp) [178.16.52.139]:62642: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:26:17 dovecot_login authenticator failed for H=(w7k2Nk) [158.94.208.175]:49903: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:27:04 dovecot_login authenticator failed for H=(2a6WC8o8) [178.16.52.139]:49243: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:27:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58805: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.152.179
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/index.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:27:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:27:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:27:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51998: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 14:27:13 dovecot_login authenticator failed for H=(T7QOTJ) [158.94.208.110]:57794: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.93.89.104
country_id: 130758
description:
Feb  2 14:27:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@astlog.com.my has been temporarily locked by Imunify PAM(185.93.89.104)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:27:58 dovecot_login authenticator failed for H=(lH7xtCh46O) [158.94.208.175]:53880: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:27:02 dovecot_login authenticator failed for H=(PxdCXw9rJ) [92.118.39.145]:51493: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:27:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:27:17 dovecot_login authenticator failed for H=(DzoyVOpzP) [165.154.235.122]:51086: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:27:21 dovecot_login authenticator failed for H=(hUpvME) [165.154.254.163]:60368: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:28:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58771: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:28:15 dovecot_login authenticator failed for H=(bTqrpc) [165.154.235.122]:49160: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:28:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-02 14:28:46 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (unrootogal) [73.196.144.25]:53228: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:28:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:28:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 14:28:25 dovecot_login authenticator failed for H=(MKKhy4) [158.94.208.110]:53105: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:28:31 dovecot_login authenticator failed for H=(j9KVbdhkwC) [158.94.208.175]:62389: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:28:23 dovecot_login authenticator failed for H=(b8H6n9gEun) [178.16.52.139]:62838: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:28:10 dovecot_login authenticator failed for H=(kKBcuODHmf) [92.118.39.145]:54346: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:28:20 dovecot_login authenticator failed for H=(LE1n26eV) [165.154.254.163]:55287: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-02-02 14:28:58 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:55350: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:29:14 dovecot_login authenticator failed for H=(fXVdK56M2) [178.16.52.139]:50679: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:29:18 dovecot_login authenticator failed for H=(lM28G3Rx) [165.154.254.163]:63326: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:29:06 dovecot_login authenticator failed for H=(lhfmcSCyQ) [158.94.208.175]:59180: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:29:12 dovecot_login authenticator failed for H=(dSKasFMTee) [165.154.235.122]:52386: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:29:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:29:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56288: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 14:29:09 H=([167.148.167.71]) [167.148.167.71]:64196 F=<Suport@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 14:29:11 dovecot_login authenticator failed for H=(ZvDUR2PB4G) [158.94.208.110]:60596: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-02-02 14:29:13 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net [111.70.22.153]:44415: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:29:19 dovecot_login authenticator failed for H=(adbvn6O1) [92.118.39.145]:57205: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:29:37 dovecot_login authenticator failed for H=(90cZjDD8c3) [165.154.254.163]:50516: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 14:29:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lambleft) [87.103.126.54]:39245: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:29:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54407: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:29:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@astlog.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 14:30:23 dovecot_login authenticator failed for H=(qN2eyKc1Hd) [158.94.208.110]:55894: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-02-02 14:30:24 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (hotics) [67.173.58.47]:54078: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:30:15 dovecot_login authenticator failed for H=(zfQ1L9U2) [165.154.254.163]:58769: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.182.46.40
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ball/262/146693 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.46
country_id: 6252001
description:
Feb  2 14:30:58 sv3 pure-ftpd[1886761]: (?@162.142.125.46) [INFO] New connection from 162.142.125.46


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:30:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:30:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:30:07 dovecot_login authenticator failed for H=(2Hu4g9) [178.16.52.139]:51257: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:30:11 dovecot_login authenticator failed for H=(W3If3jr) [165.154.235.122]:51175: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:30:15 dovecot_login authenticator failed for H=(jGjHeLEEme) [92.118.39.145]:59891: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:30:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50582: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-02-02 14:31:18 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:51586: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:31:13 dovecot_login authenticator failed for H=(dTTKAsgT) [165.154.254.163]:52339: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2026-02-02 14:31:29 dovecot_login authenticator failed for H=(201-234-106-215.static.impsat.net.ar) [201.234.106.215]:36853: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:31:37 dovecot_login authenticator failed for H=(CcbV5F9R6I) [178.16.54.138]:56571: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:31:24 dovecot_login authenticator failed for H=(sPyvdT1U) [92.118.39.145]:63107: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:31:26 dovecot_login authenticator failed for H=(ky5rvDZL) [178.16.52.139]:54312: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:31:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43860: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:31:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61690: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:31:09 dovecot_login authenticator failed for H=(lu2PLE) [165.154.235.122]:64656: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:31:10 dovecot_login authenticator failed for H=(X8JgeuOx) [158.94.208.175]:50886: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:31:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:31:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:32:16 dovecot_login authenticator failed for H=(V0E6x0) [158.94.208.175]:62750: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2026-02-02 14:32:16 dovecot_login authenticator failed for H=([14.48.112.8]) [14.48.112.8]:2391: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.124.147
country_id: 1835841
description:
2026-02-02 14:32:03 dovecot_login authenticator failed for H=([121.66.124.147]) [121.66.124.147]:54656: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:32:10 dovecot_login authenticator failed for H=(E1PeSVd) [165.154.254.163]:61464: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:32:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:32:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58405: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 14:32:25 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:20227: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:32:07 dovecot_login authenticator failed for H=(00BvvkPrO) [165.154.235.122]:56756: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23620: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:32:10 dovecot_login authenticator failed for H=(Tb54McvPj) [92.118.39.145]:65208: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:32:18 dovecot_login authenticator failed for H=(5Ah35nCli) [178.16.52.139]:59385: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:32:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:33:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:33:07 dovecot_login authenticator failed for H=(6iCt2XupSX) [165.154.254.163]:55038: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2026-02-02 14:33:50 dovecot_login authenticator failed for H=(syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:41700: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:34:02 dovecot_login authenticator failed for H=(xbPVxLUex) [165.154.235.122]:57489: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:33:04 dovecot_login authenticator failed for H=(CKIROxC) [165.154.235.122]:64091: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:33:11 dovecot_login authenticator failed for H=(8mwonoqE) [178.16.52.139]:50371: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:33:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-02-02 14:34:00 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:57304: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 14:33:04 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:52704: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:33:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:23620: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 14:33:13 H=([77.83.39.61]) [77.83.39.61]:55644 F=<oelho@projectbr.com> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:33:16 dovecot_login authenticator failed for H=(Gjo8Fxa7) [158.94.208.175]:56764: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:33:17 dovecot_login authenticator failed for H=(zIBqv80ZS) [92.118.39.145]:51779: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:34:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50384: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:33:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:33:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53491: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:35:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47744: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:34:03 dovecot_login authenticator failed for H=(VEd725) [92.118.39.145]:54081: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.32
country_id: 1269750
description:
2026-02-02 14:34:11 dovecot_login authenticator failed for H=(nsg-corporate-32.229.187.122.airtel.in) [122.187.229.32]:59641: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:34:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:34:19 dovecot_login authenticator failed for H=(ptCyK1M2) [158.94.208.175]:61995: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-02-02 14:34:35 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:45713: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:35:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.185
country_id: 2750405
description:
2026-02-02 14:34:57 292574 [Warning] Aborted connection 292574 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.185' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.33
country_id: 6252001
description:
2026-02-02 14:34:04 292536 [Warning] Aborted connection 292536 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.33' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:34:05 dovecot_login authenticator failed for H=(glTEHB6rA) [165.154.254.163]:64839: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:34:15 dovecot_login authenticator failed for H=(jmjHJshK) [178.16.52.139]:56301: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:34:21 dovecot_login authenticator failed for H=(ikEVvSC) [165.154.235.122]:50690: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:34:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 14:34:31 H=([77.83.39.61]) [77.83.39.61]:59148 F=<oelho@projectbr.com> rejected RCPT <astpkg@astlog.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:34:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64677: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-02-02 14:34:47 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net [221.120.57.125]:58990: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 14:35:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:47744: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:35:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:35:12 dovecot_login authenticator failed for H=(SFOgSScoZ) [92.118.39.145]:57496: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:35:24 dovecot_login authenticator failed for H=(uquDNLmAj) [158.94.208.175]:59270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:35:21 dovecot_login authenticator failed for H=(W2lfhbRt) [165.154.254.163]:60794: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:35:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60307: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:35:04 dovecot_login authenticator failed for H=(Q3nPylce) [178.16.52.139]:58284: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:35:18 dovecot_login authenticator failed for H=(4UgRYyZz) [165.154.235.122]:56550: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:35:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:35:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:36:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55604: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:36:19 dovecot_login authenticator failed for H=(Bbf9T1) [165.154.254.163]:53983: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:36:21 dovecot_login authenticator failed for H=(39t7k31D) [178.16.52.139]:58508: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:36:28 dovecot_login authenticator failed for H=(rgVy3Gg) [158.94.208.175]:54005: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:36:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:36:15 dovecot_login authenticator failed for H=(WJbxoBDX6W) [165.154.235.122]:60360: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:36:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:36:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:36:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54978: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:36:20 dovecot_login authenticator failed for H=(O4wvJrl) [92.118.39.145]:60629: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-02-02 14:37:06 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (perlan) [73.208.81.125]:60576: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:37:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50327: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:37:16 dovecot_login authenticator failed for H=(OkGPAo5Kf) [165.154.254.163]:63309: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 14:37:05 dovecot_login authenticator failed for H=(DoMowN2i7R) [92.118.39.145]:62497: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:37:08 dovecot_login authenticator failed for H=(v6lYgeCU) [178.16.52.139]:56504: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 14:37:30 H=([167.148.167.71]) [167.148.167.71]:59299 F=<Suport@tujusetia.my> rejected RCPT <boonpau.tan@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:37:39 dovecot_login authenticator failed for H=(03Khl0Y5D) [158.94.208.175]:56592: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:37:50 dovecot_login authenticator failed for H=(bNawnbx4) [178.16.54.138]:49905: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:37:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 14:37:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:37:13 dovecot_login authenticator failed for H=(ACXk7K7oH) [165.154.235.122]:51402: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:38:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61544: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:38:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:38:14 dovecot_login authenticator failed for H=(QBB3LRE) [165.154.254.163]:55021: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:38:22 dovecot_login authenticator failed for H=(I8dyxT8Yh) [178.16.52.139]:51249: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.90.46
country_id: 3923057
description:
2026-02-02 14:38:32 dovecot_login authenticator failed for H=host-181-114-90-46.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [181.114.90.46]:18600: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:38:57 dovecot_login authenticator failed for H=(aShSvy) [178.16.54.138]:58596: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:38:11 dovecot_login authenticator failed for H=(FGfvDbaW) [158.94.208.175]:55659: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:38:11 dovecot_login authenticator failed for H=(PH4240) [165.154.235.122]:49635: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:38:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43182: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-02-02 14:38:19 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [116.98.104.138]:35958: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:38:33 dovecot_login authenticator failed for H=(FIQo2Fbo) [165.154.254.163]:57590: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:39:10 dovecot_login authenticator failed for H=(c3JDaGG) [165.154.235.122]:60849: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.159.250
country_id: 6252001
description:
2026-02-02 14:39:45 292779 [Warning] Aborted connection 292779 to db: 'unconnected' user: 'unauthenticated' host: '159.223.159.250' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 143.198.118.227
country_id: 6252001
description:
2026-02-02 14:39:45 292780 [Warning] Aborted connection 292780 to db: 'unconnected' user: 'unauthenticated' host: '143.198.118.227' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:39:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:39:13 dovecot_login authenticator failed for H=(k8VZ6c) [178.16.52.139]:60049: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:39:15 dovecot_login authenticator failed for H=(waTDBZ) [158.94.208.175]:57631: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:39:24 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56415: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:39:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.203.184.105
country_id: 6252001
description:
2026-02-02 14:39:43 292778 [Warning] Aborted connection 292778 to db: 'unconnected' user: 'unauthenticated' host: '159.203.184.105' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:39:12 dovecot_login authenticator failed for H=(5MV2qPoDu) [165.154.254.163]:63740: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.194
country_id: 1733045
description:
2026-02-02 14:40:42 dovecot_login authenticator failed for H=([49.124.149.194]) [49.124.149.194]:58182: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:40:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52318: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:40:05 dovecot_login authenticator failed for H=(VBjR8qfTiU) [178.16.52.139]:59405: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.212.119.250
country_id: 2029969
domain: lnlfireprotection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45046.lnlfireprotection.com||ServerName:lnlfireprotection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2e7fc1d3dc50e7bc5d1395711b1a68bca7c67e8||Title:0x84a373b8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:40:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55656: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:40:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:40:25 dovecot_login authenticator failed for H=(V6tBLNgm3B) [178.16.54.138]:57730: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2026-02-02 14:40:52 dovecot_login authenticator failed for H=([192.169.120.37]) [192.169.120.37]:57945: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:40:08 dovecot_login authenticator failed for H=(dn7QNbIh2) [165.154.235.122]:63717: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:40:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:40:09 dovecot_login authenticator failed for H=(XRmBaU1nr) [165.154.254.163]:56973: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:40:22 dovecot_login authenticator failed for H=(ILoiJp1) [158.94.208.175]:52010: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:41:06 dovecot_login authenticator failed for H=(Ir0BH4) [165.154.254.163]:49802: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:41:08 dovecot_login authenticator failed for H=(GipEr9Kf5S) [165.154.235.122]:59063: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:41:29 dovecot_login authenticator failed for H=(GE8GVwIyX) [158.94.208.175]:50713: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 64.31.3.126
country_id: 6252001
domain: kimmark.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/blog/contact.php||SC:/home2/kimmark/public_html/images/blog/contact.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:41:31 dovecot_login authenticator failed for H=(64tIjQ5ha) [178.16.54.138]:61655: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:41:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:41:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:41:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63836: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:41:06 dovecot_login authenticator failed for H=(bCT4Y1s) [178.16.52.139]:50704: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:42:06 dovecot_login authenticator failed for H=(QTWbTEGmfI) [165.154.235.122]:61488: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:42:16 dovecot_login authenticator failed for H=(5pdTZwK3) [158.94.208.175]:49330: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:42:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38434: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:42:05 dovecot_login authenticator failed for H=(BHVNa8aHQ) [165.154.254.163]:58983: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-02-02 14:43:00 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:40270: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.1.175
country_id: 2510769
description:
2026-02-02 14:42:41 dovecot_login authenticator failed for H=175.red-81-43-1.staticip.rima-tde.net ([127.0.0.1]) [81.43.1.175]:45978: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-02-02 14:42:48 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:44513: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:42:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:42:38 dovecot_login authenticator failed for H=(UB64vX3c) [178.16.54.138]:49259: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:42:44 dovecot_login authenticator failed for H=(7BI8UTFcL) [165.154.254.163]:65384: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.156.239
country_id: 1814991
description:
2026-02-02 14:42:48 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.156.239]:41863: 535 Incorrect authentication data (set_id=kumara.rao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:42:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59505: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:42:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 14:42:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58494: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:42:02 dovecot_login authenticator failed for H=(OI7DnUD9g) [178.16.52.139]:51207: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:43:03 dovecot_login authenticator failed for H=(qh4UOdS) [165.154.254.163]:51916: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:43:04 dovecot_login authenticator failed for H=(noH07luOV) [165.154.235.122]:52423: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:43:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:43:18 dovecot_login authenticator failed for H=(PsR1oLF) [178.16.52.139]:62778: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:43:21 dovecot_login authenticator failed for H=(vVzA3b2GLm) [158.94.208.175]:50546: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:43:46 dovecot_login authenticator failed for H=(R8hN2p) [178.16.54.138]:51181: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:43:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:43:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58672: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 14:43:34 H=([167.148.167.71]) [167.148.167.71]:55240 F=<Suport@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:43:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 14:44:20 dovecot_login authenticator failed for H=(8JClBw) [165.154.235.122]:64855: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 14:44:25 dovecot_login authenticator failed for H=(mVCkRp) [158.94.208.175]:51282: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 14:44:51 dovecot_login authenticator failed for H=(wlWGk7) [178.16.54.138]:57098: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 14:44:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 14:44:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 14:44:09 dovecot_login authenticator failed for H=(1m1w1sHl) [178.16.52.139]:52111: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 14:44:12 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:58260: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 14:44:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 14:44:19 dovecot_login authenticator failed for H=(cYOAKmoj8p) [165.154.254.163]:63946: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 14:44:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55096: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 14:44:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49270: 535 Incorrect authentication data (set_id=info@nobledec.com)


