# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:09:06 dovecot_login authenticator failed for H=(msl7Zv) [77.83.39.61]:58152: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.205
country_id: 2661886
description:
2026-02-02 20:09:18 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.205]:37354: 535 Incorrect authentication data (set_id=mjason@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:09:57 H=(185.93.89.63) [185.93.89.63]:62210 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <scott.burr@bbgns.com>: The mail server could not deliver mail to scott.burr@bbgns.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:09:47 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (5V9Rqg) [34.101.116.145]:53982: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:09:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:09:08 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (V858zp1o7) [34.101.116.145]:51533: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:09:11 dovecot_login authenticator failed for H=(WkwpGD) [77.83.39.181]:49285: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.249.35.200
country_id: 3017382
description:
2026-02-02 20:09:23 dovecot_login authenticator failed for H=vmi3015057.contaboserver.net ([127.0.0.1]) [173.249.35.200]:36184: 535 Incorrect authentication data (set_id=mjason)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:09:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53199: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.71
country_id: 1562822
description:
2026-02-02 20:09:35 H=([103.237.86.71]) [103.237.86.71]:58122 F=<finance@bumclebanon.com> rejected RCPT <marylinkoh@ktlog.com.my>: SPF: 103.237.86.71 is not allowed to send mail from bumclebanon.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:10:04 dovecot_login authenticator failed for H=(6s4eIxsaYM) [178.16.52.139]:63403: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:10:07 dovecot_login authenticator failed for H=(QFlxb5Z7) [77.83.39.181]:53761: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 20:10:08 H=([141.98.10.106]) [141.98.10.106]:55477 F=<mselhime@drake-scruggs.com> rejected RCPT <info@cordage.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:10:12 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (cauddyng) [87.103.126.54]:13132: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:10:44 dovecot_login authenticator failed for H=(XM2NaB1q8f) [77.83.39.61]:51355: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:10:04 dovecot_login authenticator failed for H=(BdUJxX) [77.83.39.61]:61483: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:10:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (W3LN0IAv) [34.101.116.145]:54764: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:10:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:10:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49880: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:10:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:10:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.71
country_id: 1562822
description:
2026-02-02 20:10:08 H=([103.237.86.71]) [103.237.86.71]:59360 F=<finance@bumclebanon.com> rejected RCPT <info@mkmetal.com.my>: SPF: 103.237.86.71 is not allowed to send mail from bumclebanon.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:10:21 H=(185.93.89.63) [185.93.89.63]:62283 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bprainito@absolutemortgage.com>: The mail server could not deliver mail to bprainito@absolutemortgage.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:11:02 dovecot_login authenticator failed for H=(tXnshJl) [77.83.39.181]:58488: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:11:08 dovecot_login authenticator failed for H=(kUGueJXstK) [178.16.52.139]:51845: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:11:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.212.91.18
country_id: 1814991
description:
2026-02-02 20:11:25 dovecot_login authenticator failed for H=(18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [222.212.91.18]:49539: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-02-02 20:11:34 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:55802: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:11:07 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (0AmoLtfsH) [34.101.116.145]:57335: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:11:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61625: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:11:03 dovecot_login authenticator failed for H=(hceqWAY5di) [77.83.39.61]:50531: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:11:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.39.246.184
country_id: 102358
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/?page_id=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:11:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:11:08 H=(185.93.89.63) [185.93.89.63]:62382 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <sabts@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:11:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.71
country_id: 1562822
description:
2026-02-02 20:11:15 H=([103.237.86.71]) [103.237.86.71]:62212 F=<finance@bumclebanon.com> rejected RCPT <euratech@euratech.com.my>: SPF: 103.237.86.71 is not allowed to send mail from bumclebanon.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:11:56 dovecot_login authenticator failed for H=(Jy16LT86xq) [77.83.39.61]:64620: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:12:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:12:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:12:56 dovecot_login authenticator failed for H=(mStqcTf4) [77.83.39.61]:53134: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:12:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61222: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:13:02 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:12:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (qid1Tht) [34.101.116.145]:59858: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:12:16 dovecot_login authenticator failed for H=(kd0Dq9) [77.83.39.181]:64961: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:12:55 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:12:14 dovecot_login authenticator failed for H=(Lj33J4Nj95) [77.83.39.61]:56971: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:12:07 dovecot_login authenticator failed for H=(VQfnZY) [178.16.52.139]:61920: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:12:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:13:18 dovecot_login authenticator failed for H=(3cuJsnih0) [178.16.52.139]:51304: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:13:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51472: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:13:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:13:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:13:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ePTj54) [34.101.116.145]:63485: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:13:10 dovecot_login authenticator failed for H=(IwBDmcnf) [77.83.39.61]:52651: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:13:12 dovecot_login authenticator failed for H=(cpUH7QHT) [77.83.39.181]:53030: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:13:14 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:13:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:13:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57218: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:14:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (MNaESCzgR) [34.101.116.145]:50738: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:14:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53320: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:14:13 dovecot_login authenticator failed for H=(O3pJH6) [130.12.181.159]:65439: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:14:09 dovecot_login authenticator failed for H=(06HD2GXO) [77.83.39.61]:50084: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.84.23
country_id: 290557
description:
2026-02-02 20:14:58 dovecot_plain authenticator failed for H=(diaskably) [94.205.84.23]:41567: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:14:08 dovecot_login authenticator failed for H=(UGwutzOJ) [77.83.39.181]:57786: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:14:05 dovecot_login authenticator failed for H=(P1eWeW0Fy) [77.83.39.61]:62998: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:14:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:14:03 dovecot_login authenticator failed for H=(KtcumTNcMO) [178.16.52.139]:63809: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:15:11 dovecot_login authenticator failed for H=(9wg7FEcSux) [178.16.52.139]:49201: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:15:17 dovecot_login authenticator failed for H=(nh1qsHhl) [130.12.181.159]:59090: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:15:04 dovecot_login authenticator failed for H=(anaP2He) [77.83.39.181]:62161: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:15:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49766: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:15:05 dovecot_login authenticator failed for H=(IrJVLE) [77.83.39.61]:53861: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:15:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (WfS17Q305) [34.101.116.145]:55119: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 20:15:22 H=([141.98.10.106]) [141.98.10.106]:60631 F=<mselhime@drake-scruggs.com> rejected RCPT <sales@chs.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:15:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60282: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:15:05 dovecot_login authenticator failed for H=(3NnHksER) [77.83.39.61]:53857: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:15:42 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:55363: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:15:44 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:16:13 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (cc3nMR) [34.101.116.145]:59215: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:16:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:16:16 dovecot_login authenticator failed for H=(cdCNlQsoD) [77.83.39.61]:56796: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:16:17 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (chilable) [87.103.126.54]:27272: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:16:16 dovecot_login authenticator failed for H=(fdsjl7) [178.16.52.139]:64982: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:16:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64365: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-02-02 20:16:30 H=([77.83.39.188]) [77.83.39.188]:23981 F=<mustapa@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-02-02 20:16:32 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (rebed) [73.224.171.101]:35962: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:16:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:16:12 H=(185.93.89.63) [185.93.89.63]:63382 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <yxu@jtcc.edu>: The mail server could not deliver mail to yxu@jtcc.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:16:19 dovecot_login authenticator failed for H=(OSnKcVd) [77.83.39.181]:52774: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:16:20 dovecot_login authenticator failed for H=(TcQhMKMF) [130.12.181.159]:63597: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:16:18 dovecot_login authenticator failed for H=(r3QrrXb1x) [77.83.39.61]:58566: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:17:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60692: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-02-02 20:17:33 dovecot_plain authenticator failed for H=(oriatted) [65.20.160.107]:46115: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:17:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:17:07 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:17:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.79.185.164
country_id: 2802361
description:
2026-02-02 20:17:11 dovecot_login authenticator failed for H=164.185.79.34.bc.googleusercontent.com (10.132.0.2) [34.79.185.164]:52065: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:17:16 dovecot_login authenticator failed for H=(sUzzocY) [77.83.39.181]:57691: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:17:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:17:23 dovecot_login authenticator failed for H=(Xc0cLRt20) [130.12.181.159]:49160: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2026-02-02 20:17:38 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:53836: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:17:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ws93vJAUk) [34.101.116.145]:63009: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:17:11 dovecot_login authenticator failed for H=(xFclSHCW) [178.16.52.139]:57917: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:17:14 dovecot_login authenticator failed for H=(qqtkytkdWx) [77.83.39.61]:62555: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:17:15 dovecot_login authenticator failed for H=(V5TuBTGbX) [77.83.39.61]:60237: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 20:17:48 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:47173: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.92.181
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/project-references/project-puncak-gama-klr360-stp.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:18:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:18:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44812: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:18:09 dovecot_login authenticator failed for H=(SABvms51) [77.83.39.61]:50643: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:18:12 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (PreYBS) [34.101.116.145]:51320: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:18:13 dovecot_login authenticator failed for H=(kHFrfz) [77.83.39.181]:62774: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:18:07 dovecot_login authenticator failed for H=(EX47YsrRK) [130.12.181.159]:52616: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:18:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:18:51 H=(185.93.89.63) [185.93.89.63]:63998 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sbradley@wa-emp.com>: The mail server could not deliver mail to sbradley@wa-emp.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:18:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57537: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:18:14 dovecot_login authenticator failed for H=(QfUfxrbq) [178.16.52.139]:58653: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:18:27 dovecot_login authenticator failed for H=(EMEFuXA9) [77.83.39.61]:51154: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:19:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (91Bh01y9) [34.101.116.145]:54695: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:19:04 dovecot_login authenticator failed for H=(lIv6CDPdU) [77.83.39.61]:63200: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:19:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53864: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2026-02-02 20:19:13 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:59990: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-02-02 20:19:23 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:42666: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:19:24 dovecot_login authenticator failed for H=(spie5k) [77.83.39.61]:62924: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:19:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:19:14 H=(185.93.89.63) [185.93.89.63]:64097 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <steve.kronmiller@osceolamedicalcenter.com>: host lookup did not complete


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.100
country_id: 6252001
description:
Feb  2 20:19:34 sv3 pure-ftpd[2182471]: (?@199.45.155.100) [INFO] New connection from 199.45.155.100


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.118.205
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:19:09 dovecot_login authenticator failed for H=(WucyltJbCo) [77.83.39.181]:51076: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:19:15 dovecot_login authenticator failed for H=(YVtwgsV) [130.12.181.159]:60631: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:19:18 dovecot_login authenticator failed for H=(HJQulj) [178.16.52.139]:50517: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:20:05 dovecot_login authenticator failed for H=(w7Br68) [77.83.39.181]:55571: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:20:16 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.253.75
country_id: 3469034
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/project-references/project-wasan-berbuloh-mechanised-rice-scheme.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:20:32 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:63643: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:20:03 dovecot_login authenticator failed for H=(aBwxjC) [130.12.181.159]:60278: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:20:03 dovecot_login authenticator failed for H=(tIkyja9v) [77.83.39.61]:59107: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:20:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45542: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:20:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63574: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:20:11 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (J52o8Hn2GW) [34.101.116.145]:59603: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:20:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:20:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:20:03 dovecot_login authenticator failed for H=(caZWWpm) [178.16.52.139]:52987: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:20:35 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:20:38 dovecot_login authenticator failed for H=(PKOgiHCvUk) [77.83.39.61]:63490: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.213
country_id: 690791
description:
2026-02-02 20:20:38 H=([77.83.39.213]) [77.83.39.213]:54004 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<d.miyamae@guu-farm.co.jp> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.213 is not allowed to send mail from guu-farm.co.jp


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:20:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:20:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:21:20 dovecot_login authenticator failed for H=(fbQ21y) [77.83.39.181]:62084: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-02-02 20:22:01 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:53382: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:21:07 dovecot_login authenticator failed for H=(m5oGpmkYf0) [130.12.181.159]:50442: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:21:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:21:07 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ZfYblY0) [34.101.116.145]:63524: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:21:07 dovecot_login authenticator failed for H=(nWHo78RF) [178.16.52.139]:62918: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:21:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:21:39 H=(185.93.89.63) [185.93.89.63]:64569 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jvitko@mail.uch.org>: host lookup did not complete


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:21:52 dovecot_login authenticator failed for H=(pWPO4wBrmP) [77.83.39.61]:53296: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:21:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/login.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:21:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:21:14 dovecot_login authenticator failed for H=(p3lGa1nNUw) [77.83.39.61]:58286: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:21:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59283: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:22:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:22:17 dovecot_login authenticator failed for H=(2lNgKIK) [77.83.39.181]:50380: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-02-02 20:23:02 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (dinathry) [76.157.219.158]:57056: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:22:04 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:22:10 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (IdIPhb6OGX) [34.101.116.145]:52230: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.240
country_id: 2186224
description:
2026-02-02 20:22:12 dovecot_login authenticator failed for H=([121.73.168.240]) [121.73.168.240]:40134: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:22:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:22:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:22:14 dovecot_login authenticator failed for H=(d7X3an) [130.12.181.159]:59706: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-02-02 20:22:58 dovecot_plain authenticator failed for H=(roacs) [65.20.153.146]:35799: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:22:11 dovecot_login authenticator failed for H=(dUOFNNA) [77.83.39.61]:56817: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:22:16 dovecot_login authenticator failed for H=(Dlcw1O) [178.16.52.139]:58902: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:22:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56654: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 66.23.142.29
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/mke2fs.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 20:23:03 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:23:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:23:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:23:24 dovecot_login authenticator failed for H=(KrFA50dOA) [130.12.181.159]:50336: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:23:24 dovecot_login authenticator failed for H=(LLDWRwW) [178.16.52.139]:54618: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:23:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51360: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:23:32 H=(185.93.89.63) [185.93.89.63]:64859 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <kleffel@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:23:08 dovecot_login authenticator failed for H=(YdayjgZ) [77.83.39.61]:63778: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:23:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:23:18 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (kO9kDSMb) [34.101.116.145]:55902: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:23:27 dovecot_login authenticator failed for H=(4WXZrZVl) [77.83.39.61]:52483: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 140.233.190.110
country_id: 6252001
description:
2026-02-02 20:23:57 H=([140.233.190.110]) [140.233.190.110]:50355 F=<calvarezs@dualuxcr.com> rejected RCPT <info@oxbold.com>: SPF: 140.233.190.110 is not allowed to send mail from dualuxcr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:23:14 dovecot_login authenticator failed for H=(3rCefm) [77.83.39.181]:55515: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:23:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49632: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-02-02 20:24:48 dovecot_login authenticator failed for H=([31.173.0.140]) [31.173.0.140]:38884: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-02-02 20:25:01 H=([77.83.39.188]) [77.83.39.188]:38251 F=<inquiries@ktlog.com.my> rejected RCPT <inquiries@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:24:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:24:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:24:09 dovecot_login authenticator failed for H=(LPBS725Cm) [77.83.39.181]:60162: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:24:11 dovecot_login authenticator failed for H=(xbB6ZT) [130.12.181.159]:52376: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-02-02 20:24:58 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:54705: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:24:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:24:04 dovecot_login authenticator failed for H=(MD6McJUjpm) [77.83.39.61]:50771: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:24:06 dovecot_login authenticator failed for H=(thF4TWCaC) [178.16.52.139]:50271: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:24:09 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (fcYpHc) [34.101.116.145]:58739: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:24:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61505: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:24:19 H=(185.93.89.63) [185.93.89.63]:65157 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mcook@mtlm.com>: The mail server could not deliver mail to mcook@mtlm.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:24:41 dovecot_login authenticator failed for H=(VXsVuk4E) [77.83.39.61]:58255: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.206.229
country_id: 2963597
domain: tschuan.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/tschuan/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:25:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:25:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54522: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:25:40 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:25:05 dovecot_login authenticator failed for H=(h59Wp9W) [77.83.39.181]:65019: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:25:14 dovecot_login authenticator failed for H=(KGBrn7w) [130.12.181.159]:58258: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:25:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57930: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:25:17 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (aVPTKwYK0) [34.101.116.145]:61560: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:25:05 dovecot_login authenticator failed for H=(WQYye7) [178.16.52.139]:64481: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-02-02 20:25:09 dovecot_login authenticator failed for H=([125.19.172.119]) [125.20.246.106]:37014: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:25:19 dovecot_login authenticator failed for H=(bDL0Qw6fx) [77.83.39.61]:64337: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 20:25:10 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (egaisiocan) [196.47.172.253]:43737: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:25:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-02-02 20:26:12 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:51396: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:26:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54489: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:26:14 dovecot_login authenticator failed for H=(1RmXlULGV) [77.83.39.61]:56901: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:26:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-02 20:26:27 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:59928: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 20:26:30 dovecot_login authenticator failed for H=(t6DfcU) [45.94.31.131]:51085: 535 Incorrect authentication data (set_id=azman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:26:08 dovecot_login authenticator failed for H=(E8iYeQObbi) [178.16.52.139]:54365: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:26:14 dovecot_login authenticator failed for H=(txtwnrGNP5) [77.83.39.61]:51384: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:26:18 dovecot_login authenticator failed for H=(iT4Fprp) [130.12.181.159]:64798: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:26:20 dovecot_login authenticator failed for H=(aWzHIS6rzS) [77.83.39.181]:51778: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-02-02 20:26:47 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:39600: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:26:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2026-02-02 20:27:45 dovecot_plain authenticator failed for H=([10.239.0.4]) [185.225.28.227]:29311: 535 Incorrect authentication data (set_id=christina.edward@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:27:03 dovecot_login authenticator failed for H=(IalDpkQhI) [130.12.181.159]:64845: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:27:12 dovecot_login authenticator failed for H=(Rwx54zd) [178.16.52.139]:55247: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:27:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:27:40 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:27:12 dovecot_login authenticator failed for H=(oUiGpDM) [77.83.39.61]:63231: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:27:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53172: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.141.169.99
country_id: 2750405
description:
2026-02-02 20:27:33 dovecot_login authenticator failed for H=99.169.141.34.bc.googleusercontent.com (10.164.0.2) [34.141.169.99]:59146: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:27:16 dovecot_login authenticator failed for H=(uYLkaqH) [77.83.39.181]:56683: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:27:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43846: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:27:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:27:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 20:27:11 dovecot_login authenticator failed for H=(1MlQCJV) [45.94.31.131]:59753: 535 Incorrect authentication data (set_id=azman)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:27:52 dovecot_login authenticator failed for H=(FyQhbFXPJ6) [77.83.39.61]:62185: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:28:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 20:28:10 dovecot_login authenticator failed for H=(66C5uC) [45.94.31.131]:50440: 535 Incorrect authentication data (set_id=azman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:28:16 dovecot_login authenticator failed for H=(nW4mPP) [178.16.52.139]:58342: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:28:46 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:28:12 dovecot_login authenticator failed for H=(N4Mr8A) [77.83.39.61]:53351: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:28:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2026-02-02 20:28:04 dovecot_login authenticator failed for H=([10.239.0.4]) [185.225.28.227]:26350: 535 Incorrect authentication data (set_id=christina.edward@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:28:05 dovecot_login authenticator failed for H=(yQB5suZHQi) [130.12.181.159]:56052: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:28:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:28:10 H=(185.93.89.63) [185.93.89.63]:49338 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <echandler@hipage.com>: The mail server could not deliver mail to echandler@hipage.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:28:11 dovecot_login authenticator failed for H=(i9euHDJXB) [77.83.39.181]:54633: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:28:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65460: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 20:28:55 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58069: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:29:07 dovecot_login authenticator failed for H=(J1OLSpNvd) [130.12.181.159]:63328: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:29:09 dovecot_login authenticator failed for H=(MAjeQG) [77.83.39.61]:52005: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:29:24 dovecot_login authenticator failed for H=(gonrY9owm) [178.16.52.139]:52596: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:29:08 dovecot_login authenticator failed for H=(TyPEDA) [77.83.39.181]:61305: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:29:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:29:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55258: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:29:56 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:29:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:29:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:29:13 dovecot_login authenticator failed for H=(dkrzCHfd) [77.83.39.61]:49813: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:30:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.155
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/jquery.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:30:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:30:43 dovecot_login authenticator failed for H=(9OWOfrz) [77.83.39.61]:55536: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:30:11 dovecot_login authenticator failed for H=(M57P7ElEv) [130.12.181.159]:54330: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.213
country_id: 690791
description:
2026-02-02 20:30:12 H=([77.83.39.213]) [77.83.39.213]:62675 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<d.miyamae@guu-farm.co.jp> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.213 is not allowed to send mail from guu-farm.co.jp


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.74
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/modernizr.custom.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.219
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/jquery-plugin-collection.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:30:04 dovecot_login authenticator failed for H=(9txOmQh) [77.83.39.181]:51056: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:30:08 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:30:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50571: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.50
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/script.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:30:06 dovecot_login authenticator failed for H=(XCDZDbJ8) [77.83.39.61]:61941: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:30:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:30:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45650: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:30:05 dovecot_login authenticator failed for H=(KXaGaead) [178.16.52.139]:49974: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.74
country_id: 2635167
domain: fonts.googleapis.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fonts.googleapis.com/css?family=Lato:300,400,700 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.172
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/bootstrap.bundle.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.21
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/jquery.dlmenu.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:31:02 dovecot_login authenticator failed for H=(OGnVC6W1k) [77.83.39.61]:58342: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:31:06 dovecot_login authenticator failed for H=(14FnhapQY) [178.16.52.139]:50460: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:31:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63203: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:31:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:31:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:31:18 dovecot_login authenticator failed for H=(DCgytb) [77.83.39.181]:57756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 20:31:44 +0800] info [cpaneld] 185.204.54.153 - krisfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:31:18 dovecot_login authenticator failed for H=(I4OEkZm7te) [130.12.181.159]:60447: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:32:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59392: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:32:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:32:14 dovecot_login authenticator failed for H=(CR0sU3) [77.83.39.181]:62086: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:32:02 dovecot_login authenticator failed for H=(Wvs84Ijz) [130.12.181.159]:58996: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:32:19 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:32:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52518: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-02-02 20:32:52 dovecot_plain authenticator failed for H=(hypers) [65.20.148.165]:48546: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:32:11 dovecot_login authenticator failed for H=(woj5yNmR5) [178.16.52.139]:56243: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:32:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:32:16 dovecot_login authenticator failed for H=(fVNfWU) [77.83.39.61]:59773: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:32:27 H=(185.93.89.63) [185.93.89.63]:50240 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tberry@jtcc.edu>: The mail server could not deliver mail to tberry@jtcc.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:32:15 dovecot_login authenticator failed for H=(S1vjS52uj) [77.83.39.61]:52409: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-02 20:33:09 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:58576: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:33:10 dovecot_login authenticator failed for H=(IfBvusU) [178.16.52.139]:53259: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:33:10 dovecot_login authenticator failed for H=(rhhrH7I) [77.83.39.181]:50399: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-02-02 20:33:25 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:35344: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.77
country_id: 1814991
description:
2026-02-02 20:33:37 dovecot_login authenticator failed for H=([111.26.101.76]) [111.26.101.77]:43882: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:33:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56575: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:33:33 dovecot_login authenticator failed for H=(Ro3NArpTe8) [77.83.39.61]:62138: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-02-02 20:33:57 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:59917: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:33:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:33:11 dovecot_login authenticator failed for H=(ySKaCu) [77.83.39.61]:57378: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:33:30 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:34:07 dovecot_login authenticator failed for H=(v8NmbW) [77.83.39.181]:55920: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:34:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:34:07 dovecot_login authenticator failed for H=(n6r88EKOcS) [77.83.39.61]:57234: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.171.131.246
country_id: 6252001
description:
2026-02-02 20:34:48 dovecot_plain authenticator failed for H=(r1qdk8vxf7fpt68vloy0s4) [142.171.131.246]:43960: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:34:20 H=(185.93.89.63) [185.93.89.63]:50798 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sulliva@pi.cpmc.columbia.edu>: The mail server could not deliver mail to sulliva@pi.cpmc.columbia.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:34:10 dovecot_login authenticator failed for H=(4KltRqKB9) [178.16.52.139]:63863: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:34:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65056: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:35:02 dovecot_login authenticator failed for H=(YThknXR1g) [77.83.39.61]:55937: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:35:02 dovecot_login authenticator failed for H=(s1OeH1) [77.83.39.61]:58598: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:35:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:35:04 dovecot_login authenticator failed for H=(FfaKT4A) [77.83.39.181]:61679: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:35:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54652: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:35:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62263: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:35:03 dovecot_login authenticator failed for H=(KmI3SZl) [178.16.52.139]:62274: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:35:05 H=(185.93.89.63) [185.93.89.63]:50924 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jerodb@interlectric.com>: The mail server could not deliver mail to jerodb@interlectric.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:35:08 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:36:16 dovecot_login authenticator failed for H=(MFBReqc) [178.16.52.139]:54944: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-02-02 20:36:02 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:57028: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-02-02 20:37:01 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:60699: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 20:37:01 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:51074: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2026-02-02 20:36:16 dovecot_login authenticator failed for H=([183.56.179.201]) [183.56.179.201]:39964: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:36:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59094: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:36:34 dovecot_login authenticator failed for H=(KQcuI92y4) [77.83.39.61]:61092: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:36:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:36:16 dovecot_login authenticator failed for H=(OwxFISvVF) [77.83.39.61]:59752: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:36:19 dovecot_login authenticator failed for H=(TP9GXWaBw1) [77.83.39.181]:52978: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:36:31 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.24.164
country_id: 2017370
description:
2026-02-02 20:37:09 dovecot_login authenticator failed for H=([91.146.24.164]) [91.146.24.164]:57800: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:37:11 dovecot_login authenticator failed for H=(EAdB7lR) [77.83.39.61]:57299: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:37:12 dovecot_login authenticator failed for H=(UGgKbXgXz) [178.16.52.139]:52415: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:37:23 H=(185.93.89.63) [185.93.89.63]:51253 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kprendergast@perfectfitindustries.com>: The mail server could not deliver mail to kprendergast@perfectfitindustries.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:37:39 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:37:53 dovecot_login authenticator failed for H=(8fuj0T8lJ) [77.83.39.61]:51403: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:37:16 dovecot_login authenticator failed for H=(ZlzgL9zT) [77.83.39.181]:57969: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-02-02 20:37:17 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1549: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:37:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56045: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:37:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51206: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:38:06 dovecot_login authenticator failed for H=(6ENodzr) [77.83.39.61]:58749: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:38:09 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:38:10 dovecot_login authenticator failed for H=(YoP6U4) [178.16.52.139]:57999: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:38:11 dovecot_login authenticator failed for H=(4EIFkaG) [77.83.39.181]:63044: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.224.147
country_id: 1880251
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:38:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57760: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:38:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:39:08 dovecot_login authenticator failed for H=(zKqf2DZ) [178.16.52.139]:56749: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:39:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56838: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:39:07 dovecot_login authenticator failed for H=(J1rKTZ) [77.83.39.181]:51606: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.230.197
country_id: 1880251
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/airefresh/public_html/wp-includes||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:39:49 H=(185.93.89.63) [185.93.89.63]:51879 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <emark@co.boulder.co.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.38
country_id: 1835841
description:
2026-02-02 20:39:57 dovecot_login authenticator failed for H=([61.72.145.38]) [61.72.145.38]:42589: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:39:56 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:39:22 dovecot_login authenticator failed for H=(RCAMRXizp) [77.83.39.61]:51181: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:39:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:39:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:39:04 dovecot_login authenticator failed for H=(DcSk2pQ4E) [77.83.39.61]:57037: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-02-02 20:40:10 dovecot_login authenticator failed for H=([182.79.83.98]) [182.79.83.98]:59766: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:40:11 dovecot_login authenticator failed for H=(UUbwuT43N) [178.16.52.139]:52181: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:40:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:40:15 dovecot_login authenticator failed for H=(hbzmHflUp) [77.83.39.61]:57237: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:40:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:40:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:40:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53297: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:40:03 dovecot_login authenticator failed for H=(DJIihi3x7) [77.83.39.181]:56842: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:41:43 H=(185.93.89.63) [185.93.89.63]:52173 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ssmith@telleen.com>: The mail server could not deliver mail to ssmith@telleen.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:41:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49507: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:41:17 dovecot_login authenticator failed for H=(I3qzFKnpl) [77.83.39.181]:63232: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.93
country_id: 690791
description:
2026-02-02 20:41:20 H=([77.83.39.93]) [77.83.39.93]:60179 F=<Vanessa.Wang@skf.com> rejected RCPT <aoto@aoto.com.my>: SPF: 77.83.39.93 is not allowed to send mail from skf.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:41:31 dovecot_login authenticator failed for H=(CTdHnqTn6F) [77.83.39.61]:61760: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:41:05 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:41:11 dovecot_login authenticator failed for H=(0HuoM2) [77.83.39.61]:55772: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:41:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:41:17 dovecot_login authenticator failed for H=(0dO2oFm6vH) [178.16.52.139]:53658: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 20:41:03 +0800] info [cpaneld] 185.204.54.153 - masaakis "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user masaakis (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:41:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:42:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:42:21 dovecot_login authenticator failed for H=(uRWbsdEUw3) [178.16.52.139]:55270: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 20:42:44 dovecot_plain authenticator failed for H=(scuraler) [102.53.15.18]:59850: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:42:06 dovecot_login authenticator failed for H=(GCpCK8Jj) [77.83.39.61]:63681: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:42:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:42:39 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:42:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43254: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-02-02 20:42:39 dovecot_plain authenticator failed for H=(exiliase) [88.149.153.106]:38052: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:42:46 H=(185.93.89.63) [185.93.89.63]:52310 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <lleh@nwhosp.com>: The mail server could not deliver mail to lleh@nwhosp.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-02-02 20:42:06 H=([45.144.212.41]) [45.144.212.41]:64095 F=<sales@factmr.com> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from factmr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:42:13 dovecot_login authenticator failed for H=(Tjh18TVV) [77.83.39.181]:51265: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:42:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62251: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:43:09 dovecot_login authenticator failed for H=(7q1g1ajY) [178.16.52.139]:57049: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:43:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60845: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:43:03 dovecot_login authenticator failed for H=(6TpJMH) [77.83.39.61]:65528: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:43:55 H=(185.93.89.63) [185.93.89.63]:52532 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <chris@cornett-ims.com>: The mail server could not deliver mail to chris@cornett-ims.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:43:08 dovecot_login authenticator failed for H=(FoCHPb2V1H) [77.83.39.181]:56321: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:43:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:43:39 dovecot_login authenticator failed for H=(T1TaZ6J) [77.83.39.61]:56179: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:44:01 H=(185.93.89.63) [185.93.89.63]:52609 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rbarba@bordermetalstamping.com>: The mail server could not deliver mail to rbarba@bordermetalstamping.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:44:16 dovecot_login authenticator failed for H=(HRg5pGm) [77.83.39.61]:50760: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.123.224.8
country_id: 6252001
description:
[2026-02-02 20:44:41 +0800] info [whostmgrd] 69.123.224.8 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:45:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:44:03 dovecot_login authenticator failed for H=(i290VTxd) [178.16.52.139]:61427: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:44:04 dovecot_login authenticator failed for H=(Fyn2jLDotZ) [77.83.39.181]:60437: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:44:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56474: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-02 20:44:10 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (blest) [68.52.119.193]:44416: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:44:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-02-02 20:45:27 dovecot_plain authenticator failed for H=(ametitylly) [207.254.29.22]:62389: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-02-02 20:45:39 dovecot_login authenticator failed for H=([218.75.123.109]) [183.247.171.186]:45134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:45:36 H=(185.93.89.63) [185.93.89.63]:52979 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tromano@newcenturybk.com>: The mail server could not deliver mail to tromano@newcenturybk.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-02-02 20:45:05 dovecot_login authenticator failed for H=([123.212.9.122]) [123.212.9.122]:52773: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:45:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53174: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:45:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:45:12 dovecot_login authenticator failed for H=(cdDNrlnJV) [77.83.39.61]:59425: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.75
country_id: 2661886
description:
2026-02-02 20:45:33 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.75]:54926: 535 Incorrect authentication data (set_id=vekamodu@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:45:22 dovecot_login authenticator failed for H=(AdrBsp) [178.16.52.139]:58567: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:45:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:45:11 dovecot_login authenticator failed for H=(AnYU8rS2) [77.83.39.61]:59417: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:45:18 dovecot_login authenticator failed for H=(hQ0Q6y) [77.83.39.181]:51680: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:45:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41000: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.241.138.174
country_id: 1562822
description:
2026-02-02 20:45:40 dovecot_login authenticator failed for H=([127.0.0.1]) [171.241.138.174]:39591: 535 Incorrect authentication data (set_id=vekamodu)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:46:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:46:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64878: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:46:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:46:14 dovecot_login authenticator failed for H=(sBrp5Fdc) [77.83.39.61]:54315: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:46:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:46:06 dovecot_login authenticator failed for H=(Un9JWzGvJn) [77.83.39.61]:55091: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.151.36
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91191527239694 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:46:14 dovecot_login authenticator failed for H=(LpuEyS) [77.83.39.181]:56827: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:46:18 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:63671: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:46:20 dovecot_login authenticator failed for H=(mWfn9L1) [178.16.52.139]:62259: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:47:16 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (creephailt) [87.103.126.54]:23910: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:47:24 dovecot_login authenticator failed for H=(NcD9cE2kv7) [178.16.52.139]:57613: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:47:04 dovecot_login authenticator failed for H=(I4hNaZ) [77.83.39.61]:55658: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:47:23 dovecot_login authenticator failed for H=(hSJ9cG) [77.83.39.61]:60975: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:47:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60325: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-02-02 20:47:20 dovecot_plain authenticator failed for H=(stermiss) [65.20.149.93]:47104: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:47:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:47:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53140: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:47:58 dovecot_login authenticator failed for H=(Ps59POFG) [141.98.11.11]:55607: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:47:09 dovecot_login authenticator failed for H=(DantXpXB7C) [77.83.39.181]:61581: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:47:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:47:24 H=(185.93.89.63) [185.93.89.63]:53227 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <thomas.dunbar@alegent.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.84.23
country_id: 290557
description:
2026-02-02 20:47:43 dovecot_plain authenticator failed for H=(molmously) [94.205.84.23]:54212: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:47:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:48:04 dovecot_login authenticator failed for H=(LViaPD) [77.83.39.61]:51570: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:48:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56426: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:48:23 dovecot_login authenticator failed for H=(LJgfr1yN4z) [77.83.39.61]:64120: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:48:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:48:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:48:32 dovecot_login authenticator failed for H=(scwSZ0b07Z) [141.98.11.11]:60400: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.178
country_id: 290557
description:
2026-02-02 20:48:58 dovecot_plain authenticator failed for H=(sacks) [5.31.15.178]:58505: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:48:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:48:05 dovecot_login authenticator failed for H=(UAV1C8) [77.83.39.181]:49958: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:48:39 H=(185.93.89.63) [185.93.89.63]:53460 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <gadams@ahadirect.com>: The mail server could not deliver mail to gadams@ahadirect.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-02-02 20:48:55 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (addle) [76.157.219.158]:60150: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:48:07 dovecot_login authenticator failed for H=(n7Hf0Zh) [178.16.52.139]:57430: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:49:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65389: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:49:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:49:12 dovecot_login authenticator failed for H=(MUNqAaQbk) [77.83.39.61]:52603: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:49:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:49:14 dovecot_login authenticator failed for H=(Ox3UsAi) [178.16.52.139]:56727: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:49:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-02-02 20:50:00 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:63255: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:49:20 dovecot_login authenticator failed for H=(fYksJVbbs8) [77.83.39.181]:55645: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:49:29 dovecot_login authenticator failed for H=(BEHPMw7fD) [141.98.11.11]:58942: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:49:33 dovecot_login authenticator failed for H=(atsyXeMm) [77.83.39.61]:63775: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:50:16 dovecot_login authenticator failed for H=(6ZoSl2H1CN) [77.83.39.181]:60366: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:50:32 dovecot_login authenticator failed for H=(tANvOA0c) [77.83.39.61]:49869: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.92.55
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=72&page=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:50:53 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.57.70.191
country_id: 1814991
description:
2026-02-02 20:50:13 dovecot_login authenticator failed for H=([203.57.70.191]) [203.57.70.191]:44458: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:50:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 20:50:58 dovecot_plain authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:63668: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:50:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47964: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:50:25 dovecot_login authenticator failed for H=(b6SHAy1VM) [141.98.11.11]:58606: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:50:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:50:08 dovecot_login authenticator failed for H=(06b85n) [77.83.39.61]:61596: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:50:32 H=(185.93.89.63) [185.93.89.63]:53988 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <llauth@expertproducts.com>: The mail server could not deliver mail to llauth@expertproducts.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:50:07 dovecot_login authenticator failed for H=(0ZiA0xb5F) [178.16.52.139]:63689: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:51:45 H=(185.93.89.63) [185.93.89.63]:54152 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <lynch_n@westcler.org>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:51:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 20:51:04 dovecot_login authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:63668: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:51:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:51:11 dovecot_login authenticator failed for H=(XXSKF0gi) [77.83.39.181]:65167: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:51:40 dovecot_login authenticator failed for H=(rCz6etat) [141.98.11.11]:65034: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:51:42 dovecot_login authenticator failed for H=(96vzVw) [77.83.39.61]:54019: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:51:19 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59367: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:51:03 dovecot_login authenticator failed for H=(wwUKlV5) [178.16.52.139]:57007: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:51:04 dovecot_login authenticator failed for H=(bgPcnxdJ7l) [77.83.39.61]:52086: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:52:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53230: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:52:08 H=(185.93.89.63) [185.93.89.63]:54224 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <richardv@milwaukeechaplet.com>: The mail server could not deliver mail to richardv@milwaukeechaplet.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:52:12 dovecot_login authenticator failed for H=(YlNJXklfP) [141.98.11.11]:58268: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:52:07 dovecot_login authenticator failed for H=(GKBwokJt81) [77.83.39.181]:52779: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:52:25 dovecot_login authenticator failed for H=(SpAPL1U) [178.16.52.139]:51077: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:52:41 dovecot_login authenticator failed for H=(832CukLy) [77.83.39.61]:55637: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 20:52:50 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:59546: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:52:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:52:05 dovecot_login authenticator failed for H=(A22Jx0) [77.83.39.61]:49531: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:52:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50212: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 20:53:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lsst has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:53:10 dovecot_login authenticator failed for H=(eqKCm0wUkI) [178.16.52.139]:60373: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:53:21 dovecot_login authenticator failed for H=(L6zyJB9UR) [77.83.39.181]:60554: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-02 20:53:06 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (dodeckful) [73.196.144.25]:43064: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:53:14 dovecot_login authenticator failed for H=(v5qVQJqJ) [77.83.39.61]:53017: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:53:39 H=(185.93.89.63) [185.93.89.63]:54431 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mennis@businessbankva.com>: The mail server could not deliver mail to mennis@businessbankva.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:53:07 dovecot_login authenticator failed for H=(ptt5Wo3) [141.98.11.11]:50365: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 20:53:31 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:55098: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:53:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51787: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:53:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:53:51 dovecot_login authenticator failed for H=(P0xfH4) [77.83.39.61]:55160: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 20:54:06 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:54:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:54:16 dovecot_login authenticator failed for H=(zJGxoCsqJ) [77.83.39.181]:65511: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 20:54:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lsst has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:54:23 dovecot_login authenticator failed for H=(fOe4NAn) [141.98.11.11]:57916: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:54:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63046: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:54:51 dovecot_login authenticator failed for H=(65Juvt9pK) [77.83.39.61]:53006: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:54:09 dovecot_login authenticator failed for H=(fQBjcbwtiU) [77.83.39.61]:59881: 535 Incorrect authentication data (set_id=aniza)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.82.110
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/career.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:54:24 dovecot_login authenticator failed for H=(tVRRR4Wgl) [178.16.52.139]:54882: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:55:37 dovecot_login authenticator failed for H=(fWaqAs) [141.98.11.11]:52718: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:55:05 dovecot_login authenticator failed for H=(WOxQmj) [178.16.52.139]:57024: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:55:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54450: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.72.57.248
country_id: 3703430
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-token-stream/tests/TokenTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:55:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58774: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:56:01 dovecot_login authenticator failed for H=(fBYjF7E) [77.83.39.61]:50394: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:55:05 dovecot_login authenticator failed for H=(D0U4R4GxK) [77.83.39.61]:62580: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:55:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 20:55:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lsst has been locked for the attacker IP 141.98.11.11


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 182.48.94.107
country_id: 1210997
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/run/NetworkManager/resolv.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:56:03 H=(185.93.89.63) [185.93.89.63]:55025 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kristen.giessler@averionintl.com>: The mail server could not deliver mail to kristen.giessler@averionintl.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:55:11 dovecot_login authenticator failed for H=(dwdUHS3H0W) [77.83.39.181]:55136: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:56:07 dovecot_login authenticator failed for H=(dWPRpa59) [77.83.39.181]:59369: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:56:06 dovecot_login authenticator failed for H=(Gzq1tmk8z) [77.83.39.61]:55241: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:56:09 dovecot_login authenticator failed for H=(NefdkM5SLT) [141.98.11.11]:60283: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:56:18 dovecot_login authenticator failed for H=(vZrWV6) [178.16.52.139]:62395: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:56:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-02-02 20:56:40 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:43099: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:56:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-02-02 20:56:13 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:43676: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:57:01 dovecot_login authenticator failed for H=(SmoWV2KWn) [77.83.39.61]:59261: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:56:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54609: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:57:02 dovecot_login authenticator failed for H=(ycIFUAx) [77.83.39.181]:63731: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:57:09 dovecot_login authenticator failed for H=(7SxJ66W) [178.16.52.139]:56214: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:57:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33322: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:57:12 dovecot_login authenticator failed for H=(tFBY16cB) [141.98.11.11]:50613: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:57:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:57:15 dovecot_login authenticator failed for H=(fwJC0dX8) [77.83.39.61]:51445: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.106.89
country_id: 6252001
description:
2026-02-02 20:57:29 dovecot_login authenticator failed for H=71-208-106-89.ftmy.qwest.net ([127.0.0.1]) [71.208.106.89]:38068: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.155.113
country_id: 1814991
description:
2026-02-02 20:57:39 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.155.113]:52566: 535 Incorrect authentication data (set_id=achigold)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.66
country_id: 2017370
description:
2026-02-02 20:58:00 dovecot_plain authenticator failed for H=(baries) [31.173.31.66]:50692: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:57:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:57:46 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52497: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:58:08 dovecot_login authenticator failed for H=(T9c6q81rhO) [178.16.52.139]:64254: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:58:11 dovecot_login authenticator failed for H=(Ymf3YhAKpG) [77.83.39.61]:59530: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:58:36 dovecot_login authenticator failed for H=(XCJB55D) [141.98.11.11]:51972: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:58:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52497: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:58:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:58:11 dovecot_login authenticator failed for H=(ryRrmk1Rs) [77.83.39.61]:59528: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:58:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:58:16 dovecot_login authenticator failed for H=(Qu4XEmN4QN) [77.83.39.181]:54730: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:59:10 dovecot_login authenticator failed for H=(QzYqjG) [141.98.11.11]:59811: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:59:13 dovecot_login authenticator failed for H=(F2q5nECI) [77.83.39.181]:60167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 20:59:09 dovecot_plain authenticator failed for H=(inglotical) [176.113.155.132]:38509: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:59:10 dovecot_login authenticator failed for H=(ZnlXeb1) [77.83.39.61]:57163: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:59:12 dovecot_login authenticator failed for H=(h0Biz3wyC) [178.16.52.139]:62813: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:59:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-02-02 20:59:04 dovecot_plain authenticator failed for H=(unpercente) [178.165.125.212]:15718: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:59:05 dovecot_login authenticator failed for H=(TBWfD552) [77.83.39.61]:53584: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.41.213
country_id: 2017370
description:
2026-02-02 20:59:05 dovecot_login authenticator failed for H=([78.36.41.213]) [78.36.41.213]:54341: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:59:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60974: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:59:54 H=(185.93.89.63) [185.93.89.63]:55838 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <richard.brzezinski@nmg.sms.siemens.com>: The mail server could not deliver mail to richard.brzezinski@nmg.sms.siemens.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:00:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:00:15 dovecot_login authenticator failed for H=(AaPxW5iQ) [178.16.52.139]:60094: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:00:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46924: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:00:19 dovecot_login authenticator failed for H=(dlW9yZQK) [141.98.11.11]:49458: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:00:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57284: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:00:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:00:05 dovecot_login authenticator failed for H=(qGQixOho) [77.83.39.61]:55541: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:00:09 dovecot_login authenticator failed for H=(LUfPA1BD3) [77.83.39.181]:63882: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:00:22 H=(185.93.89.63) [185.93.89.63]:55904 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <redwards@edwardsconstruction.com>: The mail server could not deliver mail to redwards@edwardsconstruction.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:00:55 dovecot_login authenticator failed for H=(3hrtX8) [77.83.39.61]:55631: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.28.247
country_id: 1814991
description:
2026-02-02 21:01:30 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.28.247]:43692: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:01:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:01:03 H=(185.93.89.63) [185.93.89.63]:55997 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <daphne@teambutashomes.com>: The mail server could not deliver mail to daphne@teambutashomes.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:01:05 dovecot_login authenticator failed for H=(48fDzVCj) [77.83.39.61]:50581: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-02 21:01:07 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:43442: 535 Incorrect authentication data (set_id=info@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:01:23 dovecot_login authenticator failed for H=(sKJRA7OeT) [178.16.52.139]:58006: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:01:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53016: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-02-02 21:01:53 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:58422: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:01:04 dovecot_login authenticator failed for H=(StaIHrh) [77.83.39.181]:52829: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:01:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-02-02 21:01:38 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([127.0.0.1]) [218.103.36.176]:61416: 535 Incorrect authentication data (set_id=jesslim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.24.131
country_id: 2017370
description:
2026-02-02 21:01:44 dovecot_login authenticator failed for H=([127.0.0.1]) [178.70.24.131]:43693: 535 Incorrect authentication data (set_id=jesslim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.254.84.120
country_id: 1562822
description:
2026-02-02 21:01:23 dovecot_login authenticator failed for H=([127.0.0.1]) [222.254.84.120]:37892: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:01:29 dovecot_login authenticator failed for H=(Hulawg78tr) [141.98.11.11]:63761: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:01:42 dovecot_login authenticator failed for H=(gJugp6tI6) [77.83.39.61]:55562: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:02:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65293: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:02:22 H=(185.93.89.63) [185.93.89.63]:56175 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <denis@wwstar.com>: The mail server could not deliver mail to denis@wwstar.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:02:15 dovecot_login authenticator failed for H=(Z0nhwi) [178.16.52.139]:55415: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:02:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:02:09 dovecot_login authenticator failed for H=(Wk3oNnp9xn) [77.83.39.61]:54653: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:02:18 dovecot_login authenticator failed for H=(BjncRFuboz) [77.83.39.181]:59713: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:02:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44442: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 21:02:03 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:57960: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:02:35 dovecot_login authenticator failed for H=(lGkS1G) [77.83.39.61]:49288: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:02:07 dovecot_login authenticator failed for H=(RoUYG1p) [141.98.11.11]:50573: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:03:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55793: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 48.218.160.155
country_id: 1861060
domain: mail.nexuscollection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/nexus2019/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:03:06 dovecot_login authenticator failed for H=(tQBGJhi2i) [77.83.39.61]:64323: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:03:10 dovecot_login authenticator failed for H=(92CihF) [141.98.11.11]:54788: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:03:15 dovecot_login authenticator failed for H=(MbNSXq2j8R) [77.83.39.181]:65254: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:03:20 dovecot_login authenticator failed for H=(5rzdH96Lm) [178.16.52.139]:62405: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:03:30 dovecot_login authenticator failed for H=(eLvB64MrQ) [77.83.39.61]:55855: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:04:10 H=(185.93.89.63) [185.93.89.63]:56477 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <gennen@tribune.com>: The mail server could not deliver mail to gennen@tribune.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:04:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54070: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:04:07 dovecot_login authenticator failed for H=(v3t63tu) [178.16.52.139]:53388: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:04:08 dovecot_login authenticator failed for H=(iggtzLyi) [77.83.39.61]:51828: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:04:20 dovecot_login authenticator failed for H=(tnOyACAR) [77.83.39.61]:63393: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:04:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:04:12 dovecot_login authenticator failed for H=(7fSHBROTe) [77.83.39.181]:55006: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:04:30 dovecot_login authenticator failed for H=(rxvmOCPlCp) [141.98.11.11]:60276: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:04:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:05:32 H=(185.93.89.63) [185.93.89.63]:56887 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <scentimental@alltel.net>: host lookup did not complete


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 58.8.48.178
country_id: 1605651
description:
Feb  2 21:05:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(58.8.48.178)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:05:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60936: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-02-02 21:05:36 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:46927: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-02-02 21:05:49 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:33226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:05:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:05:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:05:07 dovecot_login authenticator failed for H=(DtoX2VJJR) [178.16.52.139]:61375: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:05:15 dovecot_login authenticator failed for H=(9F8965k) [77.83.39.61]:52108: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.16.52
country_id: 1168579
description:
2026-02-02 21:05:25 dovecot_login authenticator failed for H=([103.79.16.52]) [103.79.16.52]:41220: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 177.27.76.210
country_id: 3469034
description:
Feb  2 21:05:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(177.27.76.210)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:05:04 dovecot_login authenticator failed for H=(dtb5wIUkVI) [77.83.39.61]:62061: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:05:05 dovecot_login authenticator failed for H=(YwP48G2) [141.98.11.11]:57910: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:05:09 dovecot_login authenticator failed for H=(ttO3QEy) [77.83.39.181]:61383: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:05:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50769: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:06:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:06:11 dovecot_login authenticator failed for H=(NyijDA) [77.83.39.61]:61640: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:06:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61996: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:06:05 dovecot_login authenticator failed for H=(oAD4Ha) [77.83.39.181]:50215: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:06:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:06:12 dovecot_login authenticator failed for H=(QoF3UMU) [178.16.52.139]:50661: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:06:11 dovecot_login authenticator failed for H=(td9FG8Z6) [141.98.11.11]:57566: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.1.69.150
country_id: 2464461
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/classes/Swift/CharacterStream.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:06:57 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:06:57 dovecot_login authenticator failed for H=(0jnl4v8) [77.83.39.61]:64507: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:06:06 H=(185.93.89.63) [185.93.89.63]:56983 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jean@svbrokers.com>: The mail server could not deliver mail to jean@svbrokers.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.224.147
country_id: 1880251
domain: mail.uumism.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/uumismed/public_html/wp-admin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:07:16 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:07:06 dovecot_login authenticator failed for H=(Rah9TWpmb) [77.83.39.61]:54424: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:07:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:07:16 dovecot_login authenticator failed for H=(prqMX0pHu) [178.16.52.139]:50950: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:07:20 dovecot_login authenticator failed for H=(NsjUuUvNc) [77.83.39.181]:57376: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:07:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:07:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56780: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:07:27 dovecot_login authenticator failed for H=(C60kucSQ2l) [141.98.11.11]:56525: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:07:53 dovecot_login authenticator failed for H=(bhKTipT) [77.83.39.61]:50282: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 140.233.190.76
country_id: 6252001
description:
2026-02-02 21:08:41 H=([140.233.190.76]) [140.233.190.76]:52201 F=<ruyii@marimail.com> rejected RCPT <info@aire-fresh.com>: SPF: 140.233.190.76 is not allowed to send mail from marimail.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:08:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50858: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:08:42 dovecot_login authenticator failed for H=(4p58naYlUu) [77.83.39.61]:55316: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:08:05 dovecot_login authenticator failed for H=(QpIyj6K43) [77.83.39.61]:56214: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:08:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:08:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49226: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:08:20 dovecot_login authenticator failed for H=(BBrGtWuJlr) [141.98.11.11]:60152: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:08:09 dovecot_login authenticator failed for H=(owcXis) [178.16.52.139]:60650: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-02-02 21:08:12 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (platurdhed) [24.1.200.187]:56978: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:08:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:08:17 dovecot_login authenticator failed for H=(oHaZlHe) [77.83.39.181]:62595: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 180.178.94.243
country_id: 1643084
domain: achieversvisionacademy.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users?page=1&per_page=100||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2026-02-02 21:08:44 dovecot_login authenticator failed for H=(nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:43554: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.252.37.194
country_id: 3175395
description:
2026-02-02 21:08:54 dovecot_login authenticator failed for H=host-95-252-37-194.retail.telecomitalia.it [95.252.37.194]:41542: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:09:07 dovecot_login authenticator failed for H=(KT4Nvrfyrn) [77.83.39.61]:53924: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:09:13 dovecot_login authenticator failed for H=(XeRE6Nw) [77.83.39.181]:51446: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:09:13 dovecot_login authenticator failed for H=(JgdqA3B7) [178.16.52.139]:53251: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:09:46 H=(185.93.89.63) [185.93.89.63]:57654 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <janet@handandphysicaltherapy.org>: The mail server could not deliver mail to janet@handandphysicaltherapy.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:09:35 dovecot_login authenticator failed for H=(lVxX0S) [77.83.39.61]:60950: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:09:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:09:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:09:10 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:09:21 dovecot_login authenticator failed for H=(Xje32v4sCf) [141.98.11.11]:59827: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.92.130.3
country_id: 1814991
description:
2026-02-02 21:10:00 dovecot_login authenticator failed for H=([127.0.0.1]) [211.92.130.3]:58911: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:09:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61064: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:10:21 dovecot_login authenticator failed for H=(njej3w3) [77.83.39.61]:63490: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-02-02 21:10:22 dovecot_login authenticator failed for H=([112.161.26.125]) [112.161.26.125]:39748: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:10:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53426: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.21.213
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8268 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:10:15 dovecot_login authenticator failed for H=(6YmDOoDqF) [178.16.52.139]:59975: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:10:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56740: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:10:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:10:16 dovecot_login authenticator failed for H=(pF4dXv4ezG) [141.98.11.11]:55909: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:10:19 H=(185.93.89.63) [185.93.89.63]:57846 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dspitler@3speedys.com>: The mail server could not deliver mail to dspitler@3speedys.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-02-02 21:10:30 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:58420: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.181.216.158
country_id: 660013
description:
2026-02-02 21:10:06 dovecot_login authenticator failed for H=mail.paul42.de ([127.0.0.1]) [135.181.216.158]:40358: 535 Incorrect authentication data (set_id=kumara.rao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:10:08 dovecot_login authenticator failed for H=(BHALPNC) [77.83.39.181]:56198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-02 21:10:03 dovecot_plain authenticator failed for H=(luson) [102.53.15.180]:49500: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.135.213
country_id: 3469034
description:
2026-02-02 21:10:16 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [177.135.135.213]:46915: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:10:11 dovecot_login authenticator failed for H=(DsNJUrk) [77.83.39.61]:61314: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:11:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52375: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:11:16 dovecot_login authenticator failed for H=(24OE61) [77.83.39.61]:61222: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2026-02-02 21:11:46 dovecot_plain authenticator failed for H=c-68-38-201-238.hsd1.in.comcast.net (ableck) [68.38.201.238]:52392: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:11:09 dovecot_login authenticator failed for H=(AY7FZKW) [141.98.11.11]:52464: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 21:11:25 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:62873: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:11:04 dovecot_login authenticator failed for H=(wXoJ8V) [77.83.39.181]:60910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:11:09 dovecot_login authenticator failed for H=(Ey4nyzjeik) [178.16.52.139]:52234: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 176.175.174.92
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/sudo.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:11:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:11:06 dovecot_login authenticator failed for H=(ma7DaIq) [77.83.39.61]:60444: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.113.114
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:12:11 dovecot_login authenticator failed for H=(LgETjEai) [77.83.39.61]:63922: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:12:14 dovecot_login authenticator failed for H=(m8LKg4lY) [178.16.52.139]:49541: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:12:03 dovecot_login authenticator failed for H=(Z7qWxST) [141.98.11.11]:58313: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:12:03 dovecot_login authenticator failed for H=(SvBT8YDP30) [77.83.39.61]:65358: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:12:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63982: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:12:06 H=(185.93.89.63) [185.93.89.63]:58096 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <bmartz@martzagency.com>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:12:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-02-02 21:12:42 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net [111.70.41.88]:33647: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.245.210.70
country_id: 1814991
description:
2026-02-02 21:12:27 dovecot_login authenticator failed for H=(70.210.245.58.adsl-pool.jlccptt.net.cn) [58.245.210.70]:33269: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:13:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48732: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:13:22 dovecot_login authenticator failed for H=(iXcwmZ) [141.98.11.11]:61774: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:13:38 H=(185.93.89.63) [185.93.89.63]:58322 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <matt.mclaughlin@cunet.com>: The mail server could not deliver mail to matt.mclaughlin@cunet.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:13:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:13:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51634: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:13:06 dovecot_login authenticator failed for H=(UqMTexV) [77.83.39.61]:59882: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:13:06 dovecot_login authenticator failed for H=(uPJEd1pp) [178.16.52.139]:54360: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:13:52 dovecot_login authenticator failed for H=(P9YQKhi) [77.83.39.61]:60307: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:14:11 dovecot_login authenticator failed for H=(kPn258zT9) [178.16.52.139]:54568: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/cryptsetup.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:14:48 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:14:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64164: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:14:38 dovecot_login authenticator failed for H=(ZvcTkK8) [77.83.39.61]:64967: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.63.78.142
country_id: 6252001
description:
2026-02-02 21:14:26 dovecot_login authenticator failed for H=(ADMIN) [45.63.78.142]:65349: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:14:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:14:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:14:11 dovecot_login authenticator failed for H=(nidSnHK5i) [77.83.39.61]:62216: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:14:17 dovecot_login authenticator failed for H=(spg0XcS8tx) [141.98.11.11]:50324: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:15:07 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 21:15:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/NetworkManager/NetworkManager.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:15:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60384: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:15:06 dovecot_login authenticator failed for H=(03EGuetyk) [77.83.39.61]:61823: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:15:34 dovecot_login authenticator failed for H=(5MCPpVcmT) [77.83.39.61]:59711: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:15:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34734: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2026-02-02 21:15:30 dovecot_login authenticator failed for H=broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:42956: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-02-02 21:15:42 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:51318: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:15:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:15:15 dovecot_login authenticator failed for H=(Lm35PM33xE) [178.16.52.139]:57750: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.41.228.21
country_id: 1814991
description:
2026-02-02 21:15:23 dovecot_login authenticator failed for H=([112.48.16.186]) [120.41.228.21]:34562: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:15:34 H=(185.93.89.63) [185.93.89.63]:58819 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bill_hughes@idx.com>: The mail server could not deliver mail to bill_hughes@idx.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:15:09 dovecot_login authenticator failed for H=(k7VJE44Xi) [141.98.11.11]:55984: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:15:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:16:07 H=(185.93.89.63) [185.93.89.63]:58919 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mkepler@midstate.edu>: The mail server could not deliver mail to mkepler@midstate.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:16:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:16:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58673: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:16:23 dovecot_login authenticator failed for H=(BV9fv7jb) [141.98.11.11]:63224: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:16:28 dovecot_login authenticator failed for H=(YwZz1YYs) [77.83.39.61]:49254: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:16:04 dovecot_login authenticator failed for H=(1PekWsbQW1) [77.83.39.61]:58855: 535 Incorrect authentication data (set_id=azli)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/cloudlinux-backup-utils.log||User:root||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:16:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:16:56 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-02-02 21:17:58 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:47224: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:17:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:17:12 dovecot_login authenticator failed for H=(vJbXuOThT) [141.98.11.11]:55215: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:17:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53748: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/scripts/sync-nfs.sh.old||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:17:19 dovecot_login authenticator failed for H=(vymZus) [77.83.39.61]:50859: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-02-02 21:17:23 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:37562: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 21:17:27 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58387: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:17:06 dovecot_login authenticator failed for H=(7MwXnGlOJk) [77.83.39.61]:55387: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:17:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-02-02 21:17:43 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:45912: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-02 21:18:43 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:50638: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:18:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46560: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:18:04 dovecot_login authenticator failed for H=(E2nr4k9) [77.83.39.61]:56327: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:18:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/rsyslog.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.180.9
country_id: 2017370
description:
2026-02-02 21:18:52 dovecot_login authenticator failed for H=broadband-178-140-180-9.ip.moscow.rt.ru [178.140.180.9]:58920: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:18:07 H=(185.93.89.63) [185.93.89.63]:59194 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <howardr@actionpartners.com>: The mail server could not deliver mail to howardr@actionpartners.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:18:10 dovecot_login authenticator failed for H=(MeHdIo) [141.98.11.11]:50278: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:18:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49850: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:18:13 dovecot_login authenticator failed for H=(kiH3OTc) [77.83.39.61]:50491: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:18:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-02-02 21:18:13 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (scyacely) [73.57.80.193]:35210: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:19:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:19:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62382: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:19:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.70.149.210
country_id: 1814991
description:
2026-02-02 21:19:17 dovecot_login authenticator failed for H=([223.70.149.210]) [223.70.149.210]:35972: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/modprobe.d/firewalld-sysctls.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:19:18 dovecot_login authenticator failed for H=(uwPs14bIk) [141.98.11.11]:50459: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2026-02-02 21:19:25 dovecot_login authenticator failed for H=h77-94-125-250.static.bashtel.ru [77.94.125.250]:57027: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:19:21 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-02-02 21:19:06 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:44080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:19:09 dovecot_login authenticator failed for H=(OI2LorTRf) [77.83.39.61]:58020: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:19:53 dovecot_login authenticator failed for H=(kuAwKoE) [77.83.39.61]:58597: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:20:11 dovecot_login authenticator failed for H=(Qs42UQs) [141.98.11.11]:60678: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/modprobe.d/dist-blacklist.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 82.156.33.17
country_id: 1814991
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/3-side-seal-bag/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:20:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57500: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:20:05 dovecot_login authenticator failed for H=(U4xicabM) [77.83.39.61]:63666: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:20:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:20:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58694: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-02-02 21:20:21 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:56414: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-02-02 21:20:12 dovecot_login authenticator failed for H=([196.189.59.226]) [196.189.59.226]:56375: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:20:47 dovecot_login authenticator failed for H=(UcC3F6) [77.83.39.61]:63607: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:21:06 dovecot_login authenticator failed for H=(C4bI6JEW) [141.98.11.11]:57829: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:21:38 dovecot_login authenticator failed for H=(Y6PsiVP) [77.83.39.61]:50682: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:21:59 H=(185.93.89.63) [185.93.89.63]:60041 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <scott.buss@tdstelecom.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:21:05 dovecot_login authenticator failed for H=(PXKVoNMp) [77.83.39.61]:52889: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2026-02-02 21:21:23 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:52589: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:21:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:21:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53326: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/dovecot/auth-token-secret.dat||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2026-02-02 21:21:55 dovecot_login authenticator failed for H=([111.26.95.119]) [111.26.95.120]:53594: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.200.48.114
country_id: 1269750
description:
2026-02-02 21:21:37 dovecot_login authenticator failed for H=([121.200.48.114]) [121.200.48.114]:55128: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:22:30 dovecot_login authenticator failed for H=(y5oyAV1CHA) [141.98.11.11]:53863: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/pwquality.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:22:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2026-02-02 21:22:15 dovecot_login authenticator failed for H=([87.229.254.207]) [87.229.254.207]:54522: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:22:25 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:22:35 dovecot_login authenticator failed for H=(AiOnthDa) [77.83.39.61]:49993: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:22:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59842: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:22:02 dovecot_login authenticator failed for H=(DFAPbhq) [77.83.39.61]:49522: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:23:16 dovecot_login authenticator failed for H=(FDopipi1PW) [77.83.39.61]:63830: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:23:31 H=(185.93.89.63) [185.93.89.63]:60323 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <libbey_paul@spectramarketing.com>: The mail server could not deliver mail to libbey_paul@spectramarketing.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/chkservd.log||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:23:12 dovecot_login authenticator failed for H=(w8H8sUjVq) [77.83.39.61]:56461: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:23:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34086: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:23:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55772: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:23:03 dovecot_login authenticator failed for H=(B7SfVS7k) [141.98.11.11]:59864: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:23:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/killed_mysql_queries.log||User:manfotp3||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:24:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:24:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50446: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.255.37.149
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/File/FakeFile.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:24:32 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:24:07 dovecot_login authenticator failed for H=(7ehZfIkN) [77.83.39.61]:62952: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:24:11 dovecot_login authenticator failed for H=(5hUr0HnT) [77.83.39.61]:55044: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:24:17 dovecot_login authenticator failed for H=(CevXtvr918) [141.98.11.11]:56821: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:25:04 dovecot_login authenticator failed for H=(px73yaYfvq) [77.83.39.61]:53300: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:25:56 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:25:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:25:02 dovecot_login authenticator failed for H=(iD3ZAKIr) [141.98.11.11]:54712: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.193.213.140
country_id: 6252001
description:
2026-02-02 21:25:10 dovecot_login authenticator failed for H=ec2-44-193-213-140.compute-1.amazonaws.com (ADMIN) [44.193.213.140]:64238: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:25:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61613: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.200.210.122
country_id: 1835841
domain: solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/m.php||SC:/home2/solidfencecom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-02-02 21:25:38 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:37740: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/presets.cfg||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2026-02-02 21:25:07 dovecot_login authenticator failed for H=([111.26.100.88]) [111.26.100.88]:58746: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:25:59 H=(185.93.89.63) [185.93.89.63]:60945 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jsolley@sastandardtimes.com>: The mail server could not deliver mail to jsolley@sastandardtimes.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.200.210.122
country_id: 1835841
domain: solidfence.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/solidfencecom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:25:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55120: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-02-02 21:25:49 dovecot_login authenticator failed for H=([213.230.65.53]) [213.230.65.53]:46470: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-02-02 21:25:19 dovecot_login authenticator failed for H=([77.74.34.30]) [77.74.34.30]:46806: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:25:02 dovecot_login authenticator failed for H=(zyHzDvm) [77.83.39.61]:63677: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 21:26:05 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:51645: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:26:52 dovecot_login authenticator failed for H=(IyoLoy0) [77.83.39.61]:59060: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:26:06 dovecot_login authenticator failed for H=(IQyWfcHwK) [141.98.11.11]:63170: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:26:45 H=(185.93.89.63) [185.93.89.63]:61073 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <spallal@dandevelopment.com>: The mail server could not deliver mail to spallal@dandevelopment.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:26:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:26:15 dovecot_login authenticator failed for H=(blvKCX) [77.83.39.61]:51625: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:26:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56191: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/lvm/lvm.conf||User:root||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:27:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.199.65.190
country_id: 3686110
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/src/Psy/Command/BufferCommand.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:27:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:27:11 dovecot_login authenticator failed for H=(C4Lbnc) [77.83.39.61]:54642: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:27:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51775: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:27:23 dovecot_login authenticator failed for H=(lW3IyLhX8) [141.98.11.11]:58565: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:27:33 dovecot_login authenticator failed for H=(uaFpiUmE) [77.83.39.61]:61047: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:28:15 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:28:29 dovecot_login authenticator failed for H=(oA6DXHOBd) [77.83.39.61]:61941: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:28:09 H=(185.93.89.63) [185.93.89.63]:61276 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <cbecker@alb.edu>: The mail server could not deliver mail to cbecker@alb.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.81.139.40
country_id: 1814991
description:
2026-02-02 21:28:14 dovecot_login authenticator failed for H=([127.0.0.1]) [112.81.139.40]:32966: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:28:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:28:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:28:16 dovecot_login authenticator failed for H=(4Fnl3SmGmy) [141.98.11.11]:64970: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.156.147
country_id: 1814991
description:
2026-02-02 21:28:24 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.156.147]:40784: 535 Incorrect authentication data (set_id=boss)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:28:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51177: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:28:06 dovecot_login authenticator failed for H=(AsmFmKs) [77.83.39.61]:50645: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/captcha.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:28:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38358: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:29:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64175: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.185.152.126
country_id: 6252001
description:
[2026-02-02 21:29:39 +0800] info [cpaneld] 98.185.152.126 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:29:55 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-02-02 21:29:17 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (husnes) [73.13.220.220]:44122: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:29:04 H=(185.93.89.63) [185.93.89.63]:61436 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <acallanan@mason-city.k12.ia.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:29:07 dovecot_login authenticator failed for H=(9gGODkLko1) [141.98.11.11]:63309: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.158.44.52
country_id: 6252001
description:
[2026-02-02 21:29:46 +0800] info [cpaneld] 67.158.44.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.87.152.47
country_id: 6252001
description:
[2026-02-02 21:29:56 +0800] info [cpaneld] 67.87.152.47 - agpcorgm "GET /login/?login_only=1&user=agpcorgm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcorgm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:29:03 dovecot_login authenticator failed for H=(309zXiQ) [77.83.39.61]:56885: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.179.132
country_id: 6252001
description:
[2026-02-02 21:29:59 +0800] info [cpaneld] 172.56.179.132 - agpcorg "GET /login/?login_only=1&user=agpcorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:29:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:29:21 dovecot_login authenticator failed for H=(POVhsQG) [77.83.39.61]:55517: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.59.153.121
country_id: 6252001
description:
[2026-02-02 21:29:50 +0800] info [cpaneld] 96.59.153.121 - agpc "GET /login/?login_only=1&user=agpc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.24.203.7
country_id: 6252001
description:
[2026-02-02 21:29:53 +0800] info [cpaneld] 108.24.203.7 - agpcorgmy "GET /login/?login_only=1&user=agpcorgmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcorgmy (has_cpuser_file failed)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:29:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:30:13 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:30:38 dovecot_login authenticator failed for H=(xjRp2vCS) [141.98.11.11]:54193: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 21:30:34 dovecot_login authenticator failed for H=(InVhA7lzv) [146.70.146.50]:56124: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:30:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.82.186.55
country_id: 6252001
description:
[2026-02-02 21:30:03 +0800] info [cpaneld] 97.82.186.55 - agpcor "GET /login/?login_only=1&user=agpcor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.43.216.114
country_id: 6252001
description:
[2026-02-02 21:30:09 +0800] info [cpaneld] 99.43.216.114 - agp "GET /login/?login_only=1&user=agp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agp (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:30:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.196.204.167
country_id: 6252001
description:
[2026-02-02 21:30:12 +0800] info [cpaneld] 108.196.204.167 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:30:15 dovecot_login authenticator failed for H=(ai63Wyp) [77.83.39.61]:63793: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:30:15 dovecot_login authenticator failed for H=(RAw4Otj) [77.83.39.61]:63173: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:30:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62106: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.162.35.129
country_id: 6252001
description:
[2026-02-02 21:30:06 +0800] info [cpaneld] 165.162.35.129 - agpco "GET /login/?login_only=1&user=agpco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpco (has_cpuser_file failed)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 21:30:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account ind@indfinitydesign.com has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:30:59 H=(185.93.89.63) [185.93.89.63]:61902 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <alan@techsolution.com>: The mail server could not deliver mail to alan@techsolution.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:30:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41064: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 21:31:28 dovecot_login authenticator failed for H=(Cg09bHA) [146.70.146.50]:62148: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:31:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:31:11 dovecot_login authenticator failed for H=(tnGg5e) [77.83.39.61]:60737: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:31:11 dovecot_login authenticator failed for H=(ontE9323Dl) [77.83.39.61]:60734: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:31:05 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess6412303819/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:31:22 H=(185.93.89.63) [185.93.89.63]:61950 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <lisa@danschantz.com>: The mail server could not deliver mail to lisa@danschantz.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:31:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57457: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:31:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:31:10 dovecot_login authenticator failed for H=(EoyaDe2q9y) [141.98.11.11]:64494: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:31:59 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  2 21:32:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account ind@indfinitydesign.com has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:32:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59932: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:32:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40854: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:32:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:32:07 dovecot_login authenticator failed for H=(ePBEsZZEqz) [77.83.39.61]:54789: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  2 21:32:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account ind@indfinitydesign.com has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 21:32:17 dovecot_login authenticator failed for H=(PcuTzlUha) [146.70.146.50]:57070: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:32:11 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:32:06 dovecot_login authenticator failed for H=(xPpgaz6on) [141.98.11.11]:58078: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.58.42.234
country_id: 1522867
description:
2026-02-02 21:32:10 dovecot_plain authenticator failed for H=(tbh5y2ur0tzxno75d2z9qz00p4) [194.58.42.234]:38156: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:32:05 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess6412303819/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:32:57 H=(185.93.89.63) [185.93.89.63]:62189 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <ckrueger@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:33:05 dovecot_login authenticator failed for H=(FH0eu4yc) [141.98.11.11]:64207: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:33:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57274: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:33:03 dovecot_login authenticator failed for H=(d9jALa) [77.83.39.61]:51259: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:33:35 H=(185.93.89.63) [185.93.89.63]:62295 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <eric.moltz@ci.mercer-island.wa.us>: host lookup did not complete


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:33:05 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess6412303819/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 21:33:07 dovecot_login authenticator failed for H=(XpvWKRN) [146.70.146.50]:61828: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:33:05 dovecot_login authenticator failed for H=(MftZaNLo) [77.83.39.61]:58268: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:33:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:34:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 21:34:08 dovecot_login authenticator failed for H=(QZaTJ7Rhc) [146.70.146.50]:60877: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:34:08 dovecot_login authenticator failed for H=(H7pPTd9RO) [141.98.11.11]:58100: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:34:36 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.71
country_id: 6252001
description:
2026-02-02 21:34:48 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.71]:45356: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.97
country_id: 2661886
description:
2026-02-02 21:34:55 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.97]:48486: 535 Incorrect authentication data (set_id=joshuaooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:34:16 dovecot_login authenticator failed for H=(EC0ilZ) [77.83.39.61]:57970: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:34:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52798: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.55.237.165
country_id: 1562822
description:
2026-02-02 21:34:19 dovecot_login authenticator failed for H=([1.55.237.165]) [1.55.237.165]:42094: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  2 21:34:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.11
country_id: 1814991
description:
2026-02-02 21:34:32 dovecot_login authenticator failed for H=([27.45.232.11]) [27.45.232.11]:50009: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-02 21:35:19 dovecot_login authenticator failed for H=([125.61.36.25]) [125.61.36.22]:44594: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:35:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:35:12 dovecot_login authenticator failed for H=(hKK8AXSe) [77.83.39.61]:51292: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:35:12 dovecot_login authenticator failed for H=(N1Yb8j) [77.83.39.61]:51316: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:35:16 H=(185.93.89.63) [185.93.89.63]:62709 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <billc@dsa-erie.com>: The mail server could not deliver mail to billc@dsa-erie.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:35:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65173: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:35:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35212: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-02-02 21:35:28 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:42209: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 21:35:52 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:65384: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:35:04 dovecot_login authenticator failed for H=(nB5mr6l) [141.98.11.11]:64164: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:36:18 dovecot_login authenticator failed for H=(MKZ1jYG) [141.98.11.11]:53338: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:36:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59413: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.24.117
country_id: 1814991
description:
2026-02-02 21:36:24 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.24.117]:60476: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:36:26 H=(185.93.89.63) [185.93.89.63]:62949 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tkolaksazov@imediasolutions.com>: The mail server could not deliver mail to tkolaksazov@imediasolutions.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.15.19.170
country_id: 1814991
description:
2026-02-02 21:36:34 dovecot_login authenticator failed for H=([127.0.0.1]) [27.15.19.170]:42547: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:36:07 dovecot_login authenticator failed for H=(qWNQ00W) [77.83.39.61]:63843: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:36:53 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:36:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:36:27 dovecot_login authenticator failed for H=(pV8PIUU) [77.83.39.61]:49651: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:37:04 dovecot_login authenticator failed for H=(j8GcPc) [77.83.39.61]:50445: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:37:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49808: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:37:14 dovecot_login authenticator failed for H=(ZjOw0t) [141.98.11.11]:57203: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:37:22 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:37:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54061: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:37:59 dovecot_login authenticator failed for H=(3DYlO9yHt) [77.83.39.61]:52244: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:37:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:37:26 H=(185.93.89.63) [185.93.89.63]:63081 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mpappas@wirexgroup.com>: The mail server could not deliver mail to mpappas@wirexgroup.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:37:31 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:38:18 dovecot_login authenticator failed for H=(C1WfHCkKS) [77.83.39.61]:62702: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.77.22.240
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/letter/15/142/1525200 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:38:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:38:19 dovecot_login authenticator failed for H=(mnJiWjxBT) [141.98.11.11]:59709: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:38:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61114: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:39:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:39:13 dovecot_login authenticator failed for H=(bCu5R2U) [77.83.39.61]:59372: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:39:18 dovecot_login authenticator failed for H=(DjwqsdL) [141.98.11.11]:54003: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:39:25 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-02-02 21:39:58 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:33788: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:39:13 dovecot_login authenticator failed for H=(u117yX3DL) [77.83.39.61]:59373: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:39:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55328: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:39:06 H=(185.93.89.63) [185.93.89.63]:63362 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <carolynb@azcallateen.k12.az.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:40:11 dovecot_login authenticator failed for H=(9bSp4n) [141.98.11.11]:59558: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:40:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33014: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:40:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50594: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:40:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-02-02 21:40:08 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:46406: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:40:09 dovecot_login authenticator failed for H=(0GUP39cfXM) [77.83.39.61]:61033: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:40:29 H=(185.93.89.63) [185.93.89.63]:63730 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <dgriffith@dynamicpt.com>: host lookup did not complete


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:40:47 dovecot_login authenticator failed for H=(6RHcvjjE7J) [77.83.39.61]:50850: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:41:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:41:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60841: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:41:29 H=(185.93.89.63) [185.93.89.63]:63932 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <steve.provencal@versopaper.com>: The mail server could not deliver mail to steve.provencal@versopaper.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.220.241.50
country_id: 1814991
description:
2026-02-02 21:41:50 dovecot_login authenticator failed for H=(51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:51931: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:41:06 dovecot_login authenticator failed for H=(bQenypH) [77.83.39.61]:58428: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-02-02 21:41:07 314962 [Warning] Aborted connection 314962 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.138.206.117
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tall/14/186/1446617 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:41:17 dovecot_login authenticator failed for H=(oX1WWzy) [141.98.11.11]:65055: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2026-02-02 21:41:59 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:56098: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:42:59 dovecot_login authenticator failed for H=(9fMPsO) [165.154.252.84]:60277: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:42:18 H=(185.93.89.63) [185.93.89.63]:64031 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <semerick@airport.k12.mi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:42:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58497: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:42:20 dovecot_login authenticator failed for H=(KuCqqm) [77.83.39.61]:61298: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 21:42:08 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:52617: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:42:08 dovecot_login authenticator failed for H=(j8QBMbC) [141.98.11.11]:64118: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:42:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:42:20 dovecot_login authenticator failed for H=(ogGaWs) [77.83.39.61]:63841: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:42:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33932: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:43:10 H=(185.93.89.63) [185.93.89.63]:64187 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dau.l@ccgsystems.com>: The mail server could not deliver mail to dau.l@ccgsystems.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:43:16 dovecot_login authenticator failed for H=(ZA7JTt) [77.83.39.61]:54682: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-02-02 21:43:48 315051 [Warning] Aborted connection 315051 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:43:07 dovecot_login authenticator failed for H=(Bc7HRQQ4og) [165.154.252.84]:61823: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:43:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54019: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:43:34 dovecot_login authenticator failed for H=(LmCxksnTO) [77.83.39.61]:59824: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:43:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:43:23 dovecot_login authenticator failed for H=(Yatg3soy) [141.98.11.11]:49848: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2026-02-02 21:43:36 dovecot_login authenticator failed for H=(host-94.124.225.159.gascom.net.ru) [94.124.225.159]:40310: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.244
country_id: 1168579
description:
2026-02-02 21:43:46 dovecot_login authenticator failed for H=(244.92.zcomnetworks.com.pk) [103.148.92.244]:42798: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:44:48 dovecot_login authenticator failed for H=(hDA9T09Ad) [77.83.39.61]:64710: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:44:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50451: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-02-02 21:44:06 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:54276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:44:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.218
country_id: 1269750
description:
2026-02-02 21:44:18 dovecot_login authenticator failed for H=([127.0.0.1]) [122.185.178.218]:49036: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:44:25 H=(185.93.89.63) [185.93.89.63]:64389 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <greg.foreman@ahss.org>: The mail server could not deliver mail to greg.foreman@ahss.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.244.231.223
country_id: 1814991
description:
2026-02-02 21:44:33 dovecot_login authenticator failed for H=([127.0.0.1]) [120.244.231.223]:42299: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:44:47 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:44:09 dovecot_login authenticator failed for H=(QqoaoAf1Jf) [141.98.11.11]:64285: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:44:12 dovecot_login authenticator failed for H=(0IwOKZqGo) [77.83.39.61]:60275: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:44:16 dovecot_login authenticator failed for H=(up06hNuaS) [165.154.252.84]:61620: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:45:07 dovecot_login authenticator failed for H=(5b5fLGG) [77.83.39.61]:54720: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:45:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58206: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:45:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62313: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:45:05 dovecot_login authenticator failed for H=(DnS8hFTXb6) [141.98.11.11]:63250: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:45:05 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:45:13 dovecot_login authenticator failed for H=(apU2y3Yb9y) [165.154.252.84]:61823: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.237.221.58
country_id: 3469034
description:
2026-02-02 21:45:20 dovecot_login authenticator failed for H=152-237-221-58.user.vtal.net.br (HY-98547) [152.237.221.58]:50042: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:45:36 dovecot_login authenticator failed for H=(BTG4RdBb) [77.83.39.61]:59966: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:45:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:45:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.66
country_id: 1814991
description:
2026-02-02 21:46:34 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.66]:34546: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:46:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57136: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:46:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:46:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:46:31 dovecot_login authenticator failed for H=(iksUx5) [77.83.39.61]:53081: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-02-02 21:46:39 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:60488: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-02-02 21:46:48 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:55404: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:46:50 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-02-02 21:46:56 315146 [Warning] Aborted connection 315146 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:46:17 dovecot_login authenticator failed for H=(ilTsprp) [141.98.11.11]:51488: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:46:19 H=(185.93.89.63) [185.93.89.63]:64870 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <whiteli@citifinancial.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.75.194.67
country_id: 6252001
description:
2026-02-02 21:46:43 dovecot_login authenticator failed for H=([127.0.0.1]) [75.75.194.67]:50365: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:46:03 dovecot_login authenticator failed for H=(Kq4DySCgc) [77.83.39.61]:59166: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:46:05 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:46:10 dovecot_login authenticator failed for H=(zjaKQehdRx) [165.154.252.84]:61434: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:47:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:47:16 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:47:18 dovecot_login authenticator failed for H=(HHRG8gmGn) [77.83.39.61]:58667: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:47:21 dovecot_login authenticator failed for H=(gx6Ok03) [141.98.11.11]:59551: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:47:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:47:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53886: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:47:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52854: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:47:06 dovecot_login authenticator failed for H=(NTi0Mg3nWN) [165.154.252.84]:60519: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:47:08 dovecot_login authenticator failed for H=(3J1hRNopa) [77.83.39.61]:57733: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:48:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:48:05 dovecot_login authenticator failed for H=(9WMEuApFPc) [141.98.11.11]:63463: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:48:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63353: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:48:02 dovecot_login authenticator failed for H=(rLGE9n) [165.154.252.84]:60685: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:48:04 dovecot_login authenticator failed for H=(FLMKKP4P5) [77.83.39.61]:58980: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:48:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:48:06 H=(185.93.89.63) [185.93.89.63]:65109 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rkirkpatrick@itt-tech.edu>: The mail server could not deliver mail to rkirkpatrick@itt-tech.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:48:14 dovecot_login authenticator failed for H=(inbtECYUVp) [77.83.39.61]:63739: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:49:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:49:09 dovecot_login authenticator failed for H=(lqW9YxEhY) [77.83.39.61]:57828: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.51.49.90
country_id: 3508796
description:
2026-02-02 21:49:35 dovecot_plain authenticator failed for H=(gragnocks) [38.51.49.90]:53275: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:49:02 dovecot_login authenticator failed for H=(bPVwQOXDG) [77.83.39.61]:56877: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:49:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:49:17 dovecot_login authenticator failed for H=(51io3P) [165.154.252.84]:65305: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:49:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:50:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59788: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:49:02 dovecot_login authenticator failed for H=(XAAoTRYSA) [141.98.11.11]:49499: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:49:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:49:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58564: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:50:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53230: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:50:50 dovecot_login authenticator failed for H=(PydZJOY) [77.83.39.61]:54805: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2026-02-02 21:50:58 dovecot_login authenticator failed for H=(nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:41610: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:50:06 H=(185.93.89.63) [185.93.89.63]:49154 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <stephanie.checchi@2objet.com>: The mail server could not deliver mail to stephanie.checchi@2objet.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:50:06 dovecot_login authenticator failed for H=(PaXvmDo5zl) [77.83.39.61]:59790: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:50:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:50:10 dovecot_login authenticator failed for H=(eO2B7xqrZG) [141.98.11.11]:62130: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:50:13 dovecot_login authenticator failed for H=(Y85Ys0QA) [165.154.252.84]:54433: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-02-02 21:51:00 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (kerionocer) [71.235.225.181]:40328: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:50:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:51:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53230: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:51:15 dovecot_login authenticator failed for H=(B5NeMC) [141.98.11.11]:63563: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:51:02 dovecot_login authenticator failed for H=(iNfFB7) [77.83.39.61]:50738: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:51:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:51:10 dovecot_login authenticator failed for H=(NzwmQuK) [165.154.252.84]:52882: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:51:39 dovecot_login authenticator failed for H=(gI4Uch7qoX) [77.83.39.61]:64403: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 21:51:04 dovecot_plain authenticator failed for H=(cusly) [102.53.15.17]:42905: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.33
country_id: 2017370
description:
2026-02-02 21:51:52 dovecot_login authenticator failed for H=([31.173.2.33]) [31.173.2.33]:44060: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:51:58 H=(185.93.89.63) [185.93.89.63]:49579 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <scraven@klingshc.com>: The mail server could not deliver mail to scraven@klingshc.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:52:06 dovecot_login authenticator failed for H=(W2OWck) [165.154.252.84]:49955: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:52:15 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:52:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-02-02 21:52:09 dovecot_login authenticator failed for H=(host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:41734: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:52:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51342: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:52:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55097: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.144.80.246
country_id: 1814991
description:
2026-02-02 21:52:59 dovecot_login authenticator failed for H=([127.0.0.1]) [123.144.80.246]:33942: 535 Incorrect authentication data (set_id=cindy.mak@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:52:04 dovecot_login authenticator failed for H=(klKXcj) [77.83.39.61]:57229: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-02-02 21:52:30 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:39488: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:52:07 dovecot_login authenticator failed for H=(xGaPhZc) [141.98.11.11]:64763: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:52:14 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess6412303819/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:52:35 dovecot_login authenticator failed for H=(cJBhDecCP) [77.83.39.61]:60850: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2026-02-02 21:52:42 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:40719: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:53:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.53.224.95
country_id: 2077456
domain: www.euratech.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/euratechcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:53:03 dovecot_login authenticator failed for H=(BcCDHP0b) [165.154.252.84]:61177: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:53:14 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess6412303819/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:53:03 dovecot_login authenticator failed for H=(HgGNRiQY) [77.83.39.61]:63238: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:53:30 dovecot_login authenticator failed for H=(tewTefUEx) [77.83.39.61]:62872: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.215.103
country_id: 3144096
description:
2026-02-02 21:53:06 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.215.103]:56500: 535 Incorrect authentication data (set_id=cindy.mak)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:53:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65181: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:53:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:53:17 dovecot_login authenticator failed for H=(xlzkSIHDc) [141.98.11.11]:55991: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2026-02-02 21:54:44 dovecot_login authenticator failed for H=([213.234.8.114]) [213.234.8.114]:58816: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:54:48 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59356: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:54:07 dovecot_login authenticator failed for H=(59wuLHwzR) [77.83.39.61]:54870: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:54:15 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess6412303819/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:54:19 dovecot_login authenticator failed for H=(1KfIZ3) [165.154.252.84]:63626: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:54:33 dovecot_login authenticator failed for H=(ExvJI3) [77.83.39.61]:63080: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:54:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54458: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:54:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:54:14 dovecot_login authenticator failed for H=(annzOPe) [141.98.11.11]:58661: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-02-02 21:54:30 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:53210: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:54:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:54:18 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:55:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.152.105.149
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mtdowling/cron-expression/tests/Cron/CronExpressionTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:55:44 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:55:49 H=(185.93.89.63) [185.93.89.63]:50401 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jharris@hcr-manor.com>: The mail server could not deliver mail to jharris@hcr-manor.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:55:05 dovecot_login authenticator failed for H=(eQpazcNV) [141.98.11.11]:50619: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:56:00 H=(185.93.89.63) [185.93.89.63]:50454 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <elizabeth.schrank@ccs.k12.va.us>: The mail server could not deliver mail to elizabeth.schrank@ccs.k12.va.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:55:15 dovecot_login authenticator failed for H=(itsG7hb) [165.154.252.84]:58141: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:55:10 dovecot_login authenticator failed for H=(bRbBh3) [77.83.39.61]:59272: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:55:39 dovecot_login authenticator failed for H=(G1qbBAvCBF) [77.83.39.61]:50531: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:55:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59356: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-02-02 21:55:08 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (minate) [24.23.125.83]:54974: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:55:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.155.110
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83161516782924 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:56:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:56:04 dovecot_login authenticator failed for H=(xkCsxYX9) [77.83.39.61]:63391: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:56:18 dovecot_login authenticator failed for H=(nizw6ED) [141.98.11.11]:53357: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:56:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-02 21:56:11 315446 [Warning] Aborted connection 315446 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:56:44 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:56:41 dovecot_login authenticator failed for H=(9KgdkAQd) [77.83.39.61]:64982: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:56:11 dovecot_login authenticator failed for H=(yT4g6vL) [165.154.252.84]:53489: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.192.119
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=983961 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:56:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62324: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:57:05 dovecot_login authenticator failed for H=(6MR0Vp18UX) [141.98.11.11]:58116: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:57:08 dovecot_login authenticator failed for H=(Cis7cLmkYw) [165.154.252.84]:50542: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:57:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57669: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:57:48 dovecot_login authenticator failed for H=(4YuLVgR) [77.83.39.61]:62488: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:57:11 dovecot_login authenticator failed for H=(wOqhmxF) [77.83.39.61]:52416: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:57:45 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:57:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:57:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:57:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40536: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:58:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:58:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51773: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:58:46 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:58:50 dovecot_login authenticator failed for H=(DU9NZ6coXG) [77.83.39.61]:53109: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:58:03 dovecot_login authenticator failed for H=(i13ohqhTM9) [141.98.11.11]:59185: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:58:07 dovecot_login authenticator failed for H=(af4hS7idL) [77.83.39.61]:62706: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:58:05 dovecot_login authenticator failed for H=(WBhVcv) [165.154.252.84]:64690: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 21:58:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1@gagasanteguh.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:59:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65200: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-02 21:59:24 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:52286: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 21:59:19 dovecot_login authenticator failed for H=(MLKCqbm) [165.154.252.84]:49286: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:59:52 dovecot_login authenticator failed for H=(vufdG384g) [178.16.52.139]:62671: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:59:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.45.107
country_id: 6251999
description:
2026-02-02 21:59:13 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-91-19.cpe.i-zoom.net [24.137.45.107]:51924: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:59:22 dovecot_login authenticator failed for H=(PfBVUrAr) [141.98.11.11]:50759: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:59:59 dovecot_login authenticator failed for H=(pV8rYqk) [77.83.39.61]:53643: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 21:59:03 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "GET /cpsess6357231012/3rdparty/roundcube/?_task=mail&_mbox=INBOX&_search=d22c75adfd491bd131e12c3944feb935&_action=compose HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-02 21:59:03 315720 [Warning] Aborted connection 315720 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:59:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50804: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:59:41 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:59:08 dovecot_login authenticator failed for H=(TzJ41vuN) [77.83.39.61]:54386: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:00:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56800: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:00:47 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:00:23 dovecot_login authenticator failed for H=(cEHNiV9clY) [178.16.52.139]:64710: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 185.67.82.114
country_id: 660013
domain: thinkcloud.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:http://thinkcloud.com.my//resources-details.php?__waf_test__=' or '1'='1' union select null,'<script>alert(1)</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat /etc/passwd')#&id=1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.67.82.114
country_id: 660013
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'extractvalue(8964,concat(0x7e,(select/**/(elt(8964=8964,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:00:04 dovecot_login authenticator failed for H=(QywmFp) [77.83.39.61]:60025: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:00:27 dovecot_login authenticator failed for H=(D5VTG4YVt) [141.98.11.11]:60881: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:00:58 H=(185.93.89.63) [185.93.89.63]:51413 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <cwinders@ethicalreview.com>: The mail server could not deliver mail to cwinders@ethicalreview.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:00:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:00:16 dovecot_login authenticator failed for H=(ANvSBJ) [165.154.252.84]:62437: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:00:59 dovecot_login authenticator failed for H=(j1LaTsUxYA) [77.83.39.61]:57228: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 22:00:41 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:54644: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:01:12 dovecot_login authenticator failed for H=(urqw9Z) [165.154.252.84]:58373: 535 Incorrect authentication data (set_id=apm1@gagasanteguh.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.123.78
country_id: 1269750
description:
2026-02-02 22:01:54 dovecot_login authenticator failed for H=([127.0.0.1]) [117.206.123.78]:55693: 535 Incorrect authentication data (set_id=office@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:01:18 dovecot_login authenticator failed for H=(jBBbWU8e2) [178.16.52.139]:55959: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.26.120
country_id: 3175395
description:
2026-02-02 22:02:01 dovecot_login authenticator failed for H=([127.0.0.1]) [2.192.26.120]:41391: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 22:01:50 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:49447: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:01:16 dovecot_login authenticator failed for H=(Iz95nZV) [141.98.11.11]:49877: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:01:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:01:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52930: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:01:47 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.67.82.114
country_id: 660013
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND EXTRACTVALUE(4713,/*!50000CONCAT*/(0x7e,(/*!50000SELECT*/(ELT(4713=4713,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.67.82.114
country_id: 660013
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and extractvalue(3419,concat(0x7e,(select/**/(elt(3419=3419,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:01:25 H=(185.93.89.63) [185.93.89.63]:51537 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <sdocker@msnc.org>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:01:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56568: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:01:13 dovecot_login authenticator failed for H=(pUPqr4) [77.83.39.61]:63853: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:01:44 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.223.185.176
country_id: 1227603
description:
2026-02-02 22:01:57 dovecot_login authenticator failed for H=(pspoly.com.my) [111.223.185.176]:23710: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: modsec
rule: 77674285
name: IM360 WAF: Shell upload attempt
abuser: 45.3.50.1
country_id: 6252001
domain: astlog.com.my
description:
IM360 WAF: Shell upload attempt||MVN:ARGS:form_fields[message]||MV:Stop lying to yourself. If you\xe2\x80\x99re stuck selling one-off products, you aren\xe2\x80\x99t a business owner\xe2\x80\x94you\xe2\x80\x99re a slave to the next sale. Every single month, your bank account resets to zero, and you\xe2\x80\x99re forced back onto the \"entrepreneurial hamster wheel\". It\xe2\x80\x99s exhausting, it's demoralizing, and it\xe2\x80\x99s stealing your financial freedom.\r\nThe R.A.P.I.D. TimeShift\xe2\x84\xa2 System is your only way out. It is a \"set-it-and-forget-it\" blueprint designed to build predictable monthly income that deposits money into your account like clockwork.\r\n\r\nGet Out of the Trap Here: https://indianxvideos.site/RapidRecurringRevenue?domain=astlog.com.my \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nYou are getting this email \r\nas we believe \r\nthe offer we provide \r\ncould be relevant to you.\r\n\r\nIf you don\xe2\x80\x99t want to receive \r\nadditional emails from us, \r\nsimply \r\nstop receiving emails:\r\n\r\nhttps://indianxvideos.site/unsub?domain=astlog.com.my \r\nAddress: Address: 2321   4665 Lunetta Street, FL  34242\r\nLooking out for you, Jestine Foulds.||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:02:27 dovecot_login authenticator failed for H=(TJlOLlpe2d) [141.98.11.11]:63168: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:02:59 H=(185.93.89.63) [185.93.89.63]:51735 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <khedges@mediapolis.k12.ia.us>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:02:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:02:08 dovecot_login authenticator failed for H=(6fmwUBSUte) [77.83.39.61]:57526: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.223.185.176
country_id: 1227603
description:
2026-02-02 22:02:05 dovecot_plain authenticator failed for H=(pspoly.com.my) [111.223.185.176]:23710: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:02:09 dovecot_login authenticator failed for H=(2kPfxVEk) [77.83.39.61]:63756: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:02:13 dovecot_login authenticator failed for H=(Np5ffWIec) [178.16.52.139]:59394: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:02:09 dovecot_login authenticator failed for H=(taIwjI) [165.154.252.84]:61023: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:02:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62430: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:03:03 dovecot_login authenticator failed for H=(eYhLVu) [77.83.39.61]:55618: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:03:12 dovecot_login authenticator failed for H=(FVVZ2Az) [178.16.52.139]:61303: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:03:23 dovecot_login authenticator failed for H=(YOkbPO1) [141.98.11.11]:49880: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:03:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61021: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-02 22:03:36 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:44546: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-02-02 22:03:58 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:57650: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:03:06 dovecot_login authenticator failed for H=(wKIrRYSxEg) [77.83.39.61]:55340: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:03:48 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.25.184
country_id: 1522867
description:
2026-02-02 22:03:47 dovecot_login authenticator failed for H=2.135.25.184.dynamic.telecom.kz [2.135.25.184]:46172: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:03:05 dovecot_login authenticator failed for H=(oOlo37) [165.154.252.84]:63325: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:03:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-02-02 22:03:22 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:33180: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:04:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:04:17 dovecot_login authenticator failed for H=(YI78YUQjyb) [77.83.39.61]:56290: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:04:08 H=(185.93.89.63) [185.93.89.63]:51904 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jspangler@magnaint.com>: The mail server could not deliver mail to jspangler@magnaint.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:04:10 dovecot_login authenticator failed for H=(GrNK8YkZ) [178.16.52.139]:61983: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:04:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:04:48 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:04:20 dovecot_login authenticator failed for H=(sVEBiGSRBV) [165.154.252.84]:52294: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:04:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56958: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:04:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:04:12 dovecot_login authenticator failed for H=(8rbGahjblG) [141.98.11.11]:55288: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:04:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53782: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:04:17 dovecot_login authenticator failed for H=(MrZ5MT0H8) [77.83.39.61]:56060: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:05:49 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:05:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:05:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:05:12 dovecot_login authenticator failed for H=(AeDS9dyYUw) [77.83.39.61]:51989: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:05:21 dovecot_login authenticator failed for H=(9mFHBn) [141.98.11.11]:61305: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:05:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50779: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 22:06:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:05:05 dovecot_login authenticator failed for H=(XF9v9i) [178.16.52.139]:63680: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:05:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:05:14 dovecot_login authenticator failed for H=(cnWK0OKsZ) [77.83.39.61]:59631: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:05:16 dovecot_login authenticator failed for H=(8kIcc5It7F) [165.154.252.84]:64423: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:06:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:06:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:06:23 H=(185.93.89.63) [185.93.89.63]:52511 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <matt.beatty@cmaltd.com>: The mail server could not deliver mail to matt.beatty@cmaltd.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 22:06:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:06:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61523: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:06:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48860: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:06:03 dovecot_login authenticator failed for H=(8hRcsFwK) [141.98.11.11]:55105: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-02-02 22:06:04 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (subles) [174.166.153.20]:46238: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:06:12 dovecot_login authenticator failed for H=(7Sn1cT) [165.154.252.84]:60090: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:06:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 22:06:59 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:54427: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:06:07 dovecot_login authenticator failed for H=(9piv81KK) [77.83.39.61]:56663: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:06:25 dovecot_login authenticator failed for H=(O2PkatKTU) [77.83.39.61]:54881: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:06:27 dovecot_login authenticator failed for H=(laRbfh0) [178.16.52.139]:62962: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:07:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56784: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:07:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:07:06 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:07:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:07:25 dovecot_login authenticator failed for H=(RnDnhb) [77.83.39.61]:49658: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:07:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:07:28 dovecot_login authenticator failed for H=(6BeduBkafx) [178.16.52.139]:63829: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 22:07:41 +0800] info [cpaneld] 185.204.54.153 - mail "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mail (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:07:05 dovecot_login authenticator failed for H=(AhmwTpa) [77.83.39.61]:50177: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 22:07:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:07:10 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "GET /cpsess5661732796/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:07:10 dovecot_login authenticator failed for H=(u3fY0JhL) [141.98.11.11]:62248: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:07:09 dovecot_login authenticator failed for H=(1jyCxdwB) [165.154.252.84]:57615: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:08:06 dovecot_login authenticator failed for H=(LKslmQUV) [165.154.252.84]:51444: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.181.7
country_id: 1814991
description:
2026-02-02 22:08:09 dovecot_login authenticator failed for H=([61.145.181.7]) [61.145.181.7]:52592: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.209.252.178
country_id: 1269750
description:
2026-02-02 22:08:26 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [154.209.252.178]:44498: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:08:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53942: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:08:35 dovecot_login authenticator failed for H=(c52hMPv30j) [77.83.39.61]:63199: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:08:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:08:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:08:19 dovecot_login authenticator failed for H=(HlL12RhCkr) [141.98.11.11]:55527: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:08:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:08:50 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:08:20 H=(185.93.89.63) [185.93.89.63]:52756 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jesse.hoffbauer@duluth.k12.mn.us>: The mail server could not deliver mail to jesse.hoffbauer@duluth.k12.mn.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:08:21 dovecot_login authenticator failed for H=(gj6hX4tjt) [178.16.52.139]:55974: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:08:04 dovecot_login authenticator failed for H=(wpvu6z) [77.83.39.61]:64098: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2026-02-02 22:08:18 dovecot_login authenticator failed for H=host59.sub-63-47-149.myvzw.com [63.47.149.59]:58803: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:09:13 dovecot_login authenticator failed for H=(NLjmgGDle1) [77.83.39.61]:54649: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:09:22 dovecot_login authenticator failed for H=(z9Ka2H) [165.154.252.84]:51848: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:09:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52025: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.223.203.1
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=2&sub=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:09:09 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:09:26 dovecot_login authenticator failed for H=(BTfDjwBU) [141.98.11.11]:60744: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:09:35 dovecot_login authenticator failed for H=(JAL5Kf) [77.83.39.61]:56352: 535 Incorrect authentication data (set_id=fadilah)


