# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:00:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:00:21 dovecot_login authenticator failed for H=(TTXeP3Q) [178.16.52.139]:65393: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-02-01 15:00:46 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:43844: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:00:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53230: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:01:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:01:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58882: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:01:19 dovecot_login authenticator failed for H=(dLTl6MOhKR) [158.94.208.175]:49937: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 15:01:25 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:50904: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:01:03 dovecot_login authenticator failed for H=(uiwsjGi) [178.16.52.139]:57011: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d46bda3e833ab9b78f85dbea9ddbe0bba7080d5||Title:0xcce54a5d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:02:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48154: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1f48a1fe70edf664683b9150822a56b4c1dcfa8||Title:0x4d3970de||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:02:07 dovecot_login authenticator failed for H=(99QAyp) [178.16.52.139]:62527: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:02:08 dovecot_login authenticator failed for H=(wstxEFB) [178.16.54.22]:52872: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:02:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:02:03 dovecot_login authenticator failed for H=(MBwPuc0g) [158.94.208.175]:58279: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:02:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54506: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:03:27 dovecot_login authenticator failed for H=(jFYO9O) [158.94.208.175]:61729: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:03:23 dovecot_login authenticator failed for H=(JtgVFgZq) [178.16.54.22]:63538: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:03:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64097: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:03:14 dovecot_login authenticator failed for H=(N8U4yS5n) [178.16.52.139]:63483: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 15:04:41 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:55236: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:04:42 dovecot_login authenticator failed for H=(AGQECCx) [178.16.54.22]:51383: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2026-02-01 15:04:47 dovecot_login authenticator failed for H=([111.26.63.82]) [111.26.63.83]:38014: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:04:08 dovecot_login authenticator failed for H=(ClM4lYu7j) [178.16.52.139]:53965: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:04:18 dovecot_login authenticator failed for H=(7S5uin5DF) [178.16.52.139]:62548: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-01 15:04:29 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:42258: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-02-01 15:04:59 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:46810: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:04:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53710: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 15:05:01 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:60920: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:04:16 dovecot_login authenticator failed for H=(qDOkmT) [158.94.208.175]:55190: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa8b2fbb3e723a8df0bcf8e574530dc9f6fa1f88||Title:0x63d75884||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 15:05:10 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:44162: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02e565a6b8a79205bbdafb8af227f7cfe2f13119||Title:0xe903e30d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:05:37 dovecot_login authenticator failed for H=(dhqZCYkW) [178.16.54.22]:56071: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 15:05:51 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:52473: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:05:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54370: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:05:09 dovecot_login authenticator failed for H=(5GzAVGo) [158.94.208.175]:50699: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:05:12 dovecot_login authenticator failed for H=(Pt4XWZ) [178.16.52.139]:57644: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:05:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49899: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:06:14 dovecot_login authenticator failed for H=(Z7bGg8Hyu) [158.94.208.175]:59494: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:13f474ade6c7b89bfc84478ea25a4e0b019b1b13||Title:0xc3df3b82||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:06:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56458: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 15:06:02 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:33970: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:06:08 dovecot_login authenticator failed for H=(E5EnSiMoa) [178.16.52.139]:56136: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-02-01 15:06:12 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:34580: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 15:07:20 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:42656: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.198.83
country_id: 1327865
description:
2026-02-01 15:07:18 dovecot_plain authenticator failed for H=(Q171B58071) [103.197.198.83]:56596: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:07:29 dovecot_login authenticator failed for H=(26ecJs60Pg) [158.94.208.175]:50590: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53be31ca7d16baeb20681a63093eaf65f0e91829||Title:0xcc0199bb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:07:06 dovecot_login authenticator failed for H=(OJzW4r) [178.16.54.22]:51918: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:07:08 dovecot_login authenticator failed for H=(psNIXLi7) [178.16.52.139]:65349: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 15:07:41 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:47238: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.38.92
country_id: 390903
description:
2026-02-01 15:07:32 dovecot_plain authenticator failed for H=(propary) [149.210.38.92]:39553: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 15:07:33 228605 [Warning] Aborted connection 228605 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 101.0.38.15
country_id: 1269750
domain: symphony-led.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49393.symphony-led.com||ServerName:symphony-led.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4594accfc416e9ab830fbd2678cd511722d258c0||Title:0xa31725e0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:07:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62275: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:07:30 dovecot_login authenticator failed for H=(rFn1jQzX3v) [178.16.52.139]:51201: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 15:07:05 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:34148: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:07:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33676: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 15:08:30 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:34952: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:08:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:119f84a5c92cea5623b1d2b4f01c978e3dda2bac||Title:0x9aca936f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:08:19 dovecot_login authenticator failed for H=(5ZPUITMoBg) [158.94.208.175]:53020: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 15:08:43 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:35728: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-02-01 15:09:01 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:51781: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-02-01 15:08:58 dovecot_login authenticator failed for H=([223.26.225.129]) [210.206.24.234]:32161: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 15:08:02 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:35666: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:08:10 dovecot_login authenticator failed for H=(Ko9LqyGe5o) [178.16.52.139]:65377: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:08:46 dovecot_login authenticator failed for H=(rYzXUiGlws) [178.16.54.22]:56333: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:09:57 dovecot_login authenticator failed for H=(TVDbQeHZYH) [178.16.54.22]:62412: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-01 15:09:11 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:63987: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-02-01 15:09:40 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:33072: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-02-01 15:09:56 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:40352: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:09:09 dovecot_login authenticator failed for H=(4myoxPmHyQ) [178.16.52.139]:63631: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:09:22 dovecot_login authenticator failed for H=(qzaU3Fj) [158.94.208.175]:57135: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
country_id: 1835841
description:
2026-02-01 15:09:03 dovecot_login authenticator failed for H=([223.171.89.199]) [223.171.89.199]:47446: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:09:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34948: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:09:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49913: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:10:06 dovecot_login authenticator failed for H=(Z4BVEw2F) [158.94.208.175]:53704: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e76e8a75cb2c19450ca7ee40c59240bda6475e5||Title:0x299d0095||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:10:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55699: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:10:21 dovecot_login authenticator failed for H=(P5taH0MoOl) [178.16.52.139]:61044: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:11:28 dovecot_login authenticator failed for H=(MLx2IcELfM) [178.16.54.22]:50150: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:11:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52266: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:11:11 dovecot_login authenticator failed for H=(g0LFt0wq) [178.16.52.139]:58109: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 15:11:15 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:59094: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:11:18 dovecot_login authenticator failed for H=(7oA0iG) [158.94.208.175]:61884: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca9ecad6f51c17d664cc322e030a17f9fb73e566||Title:0x634c941b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 15:11:36 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46884: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.13.8.125
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=126424 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:11:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61444: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:11:18 dovecot_login authenticator failed for H=(3MW4Wx) [178.16.52.139]:51602: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:12:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50547: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:12:07 dovecot_login authenticator failed for H=(rydAiuPot) [178.16.54.22]:56599: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fece8cc6bb4afac2c62c196e967350fdd36da7ea||Title:0x2d5354c3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 15:12:31 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:35440: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:12:14 dovecot_login authenticator failed for H=(ithWr2) [178.16.52.139]:57312: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-02-01 15:12:11 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:53303: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:12:19 dovecot_login authenticator failed for H=(4IOiiVt) [158.94.208.175]:63513: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-02-01 15:12:59 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (ankines) [68.82.141.145]:39354: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 15:12:25 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:6834: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 15:12:54 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:43760: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:13:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63768: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:13:26 dovecot_login authenticator failed for H=(za6eIKKy) [158.94.208.175]:52588: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ac63eb4a98bd50636dc41e16996b9a4fb4e4175b||Title:0xb094024d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:13:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50570: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:13:21 dovecot_login authenticator failed for H=(wzL92LljYY) [178.16.52.139]:60139: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:14:18 dovecot_login authenticator failed for H=(S2fmce) [158.94.208.175]:58958: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:14:21 dovecot_login authenticator failed for H=(Hh1pV2rC) [178.16.52.139]:63251: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0f57dfa95622982247905eaeeb9328ef18d3da82||Title:0x40d8dace||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:14:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54048: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:14:14 dovecot_login authenticator failed for H=(GEnU54Z) [178.16.52.139]:59239: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.166
country_id: 2635167
description:
2026-02-01 15:14:13 228846 [Warning] Aborted connection 228846 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.166' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.230
country_id: 1643084
description:
[2026-02-01 15:14:55 +0800] info [cpaneld] 95.135.93.230 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:15:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40924: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:15:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59709: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-02-01 15:15:21 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (tablea) [98.193.112.85]:48996: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cce6811139cc5d93f9e39ec8fce70d601212daad||Title:0xda5b9b10||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:15:16 dovecot_login authenticator failed for H=(KdB1kcLTO) [178.16.52.139]:51044: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:15:06 dovecot_login authenticator failed for H=(jOnZoBFPC) [158.94.208.175]:55944: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.110.13.60
country_id: 2635167
description:
2026-02-01 15:15:16 dovecot_plain authenticator failed for H=([10.27.18.189]) [194.110.13.60]:55849: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-01 15:16:35 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:56396: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:16:38 dovecot_login authenticator failed for H=(CVmqlHjAZK) [158.94.208.175]:60193: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2026-02-01 15:16:40 dovecot_login authenticator failed for H=syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:57997: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.180
country_id: 6252001
description:
2026-02-01 15:16:52 dovecot_login authenticator failed for H=(89.187.173.180) [89.187.173.180]:49000: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:16:10 dovecot_login authenticator failed for H=(0o1GOzI) [178.16.52.139]:50298: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:16:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54712: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f7af2529dcf2f8424abad95fd3741c67800c0d05||Title:0xfe223757||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:16:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:16:13 dovecot_login authenticator failed for H=(vRdWV9TN) [178.16.54.22]:51275: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 15:16:55 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:60659: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 15:17:29 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:38590: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 15:17:46 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:38330: 535 Incorrect authentication data (set_id=fasya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:17:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60566: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:17:24 dovecot_login authenticator failed for H=(luXeCx) [178.16.52.139]:59943: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-01 15:17:30 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:48866: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:17:32 dovecot_login authenticator failed for H=(jER6IZ) [178.16.54.22]:53407: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:17:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:17:16 dovecot_login authenticator failed for H=(07ySET) [178.16.52.139]:52236: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:17:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50896: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:17:03 dovecot_login authenticator failed for H=(Wa6tmLrEa) [158.94.208.175]:50494: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 15:17:08 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:34272: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a234f3d5f95d0e8dd67c461e1fad5ad3d0dd4072||Title:0x3fdd56d2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:18:04 dovecot_login authenticator failed for H=(rKhX81bk) [178.16.52.139]:57312: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:18:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57055: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 15:18:16 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:18886: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:18:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 15:18:25 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:48408: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.222.194
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28091532676614 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:18:06 dovecot_login authenticator failed for H=(nGCiDB8S7B) [158.94.208.175]:54448: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:18:09 dovecot_login authenticator failed for H=(GS4eroLn) [178.16.54.22]:56155: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5c15cc54fe6acf262adc1c527a906607f12a5a8e||Title:0xfe3cb1d9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:19:03 dovecot_login authenticator failed for H=(deWJXP8D) [178.16.54.22]:64119: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 15:19:07 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:19:08 dovecot_login authenticator failed for H=(aV8Sdzh) [178.16.52.139]:58462: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 15:19:28 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:51573: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a34284625df0ba6eeda160241b7652304948f8b||Title:0x60e14347||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:19:07 dovecot_login authenticator failed for H=(48LJfCCgqP) [158.94.208.175]:49552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:19:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63443: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-01 15:19:21 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:51140: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 15:19:35 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:49784: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:20:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58629: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:20:22 dovecot_login authenticator failed for H=(u6Jwywlk) [158.94.208.175]:50923: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:20:14 dovecot_login authenticator failed for H=(vlAKvF) [178.16.54.22]:54636: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:20:07 dovecot_login authenticator failed for H=(Xz17Sugd) [178.16.52.139]:51358: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2767e199b8793a644aa55c01406934e68510c9ed||Title:0xffdb8629||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:20:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:20:02 dovecot_login authenticator failed for H=(SfGqO3n) [178.16.52.139]:59283: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 103.58.75.88
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:Fuzz Faster U Fool v2.0.0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:20:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39372: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:21:16 dovecot_login authenticator failed for H=(nBkQdef) [158.94.208.175]:55133: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e44507575b724cd7e3c80bcb4198f6166cae6f4d||Title:0xfcb54073||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:21:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65002: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:21:28 dovecot_login authenticator failed for H=(5FVulA) [178.16.54.22]:54154: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.105.90
country_id: 3895114
description:
2026-02-01 15:21:04 dovecot_plain authenticator failed for H=(UJZECE2W) [186.189.105.90]:53310: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:21:09 dovecot_login authenticator failed for H=(hZUL5kg) [178.16.52.139]:56047: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 15:22:23 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:43156: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:22:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.72.61.166
country_id: 1210997
description:
[2026-02-01 15:22:38 +0800] info [webmaild] 103.72.61.166 - central@agpc.org.my "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:22:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54936: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:22:12 dovecot_login authenticator failed for H=(9NDAfV) [178.16.52.139]:53589: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3cf00118057f75d409702d2293e26882771bc14f||Title:0xc8fb1d41||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:22:52 dovecot_login authenticator failed for H=(5fDe1tp8) [178.16.52.139]:59853: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-01 15:22:56 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:40906: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:22:05 dovecot_login authenticator failed for H=(RvEuST) [178.16.54.22]:51638: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.205.245.9
country_id: 1269750
description:
2026-02-01 15:22:47 dovecot_plain authenticator failed for H=(6LCBR6) [49.205.245.9]:8317: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:22:22 dovecot_login authenticator failed for H=(Dpl4QmdO) [158.94.208.175]:55092: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:23:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52624: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:23:14 dovecot_login authenticator failed for H=(965Xkzd0Ps) [178.16.54.22]:53645: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:23:14 dovecot_login authenticator failed for H=(91BVLk) [178.16.52.139]:60864: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:23:28 dovecot_login authenticator failed for H=(mUrpSZO90N) [158.94.208.175]:62994: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd8feec6e12c2250e9f5efdd8221d5d0cdf8c072||Title:0x74d58f75||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:24:12 dovecot_login authenticator failed for H=(ZZ43sjhs1U) [178.16.52.139]:60570: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:24:26 dovecot_login authenticator failed for H=(ocUzRrgyX) [178.16.54.22]:55957: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:24:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 15:24:49 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (subscuroum) [87.103.126.54]:52927: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:24:04 dovecot_login authenticator failed for H=(hykESx) [158.94.208.175]:65182: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-02-01 15:24:29 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:58429: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:24:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52581: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.41.228.21
country_id: 1814991
description:
2026-02-01 15:24:19 dovecot_login authenticator failed for H=([112.48.16.186]) [120.41.228.21]:51958: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3b83931ef037b242fc1842d5c9030de09a488e6||Title:0xd8bbf335||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:25:10 dovecot_login authenticator failed for H=(jDL66Lhl) [158.94.208.175]:62139: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:25:10 dovecot_login authenticator failed for H=(HNnB5I0kt) [178.16.52.139]:55328: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 15:25:18 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:37019: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:25:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64736: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:25:01 dovecot_login authenticator failed for H=(OTXe43wkS) [178.16.54.22]:56778: 535 Incorrect authentication data (set_id=jon)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a8655db172add8469597506069775d3b51b08d70||Title:0x83c932fa||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 15:25:50 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:39004: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.223.129.28
country_id: 1668284
description:
2026-02-01 15:26:06 dovecot_plain authenticator failed for H=61-223-129-28.dynamic-ip.hinet.net (X58MAJ152S6) [61.223.129.28]:13229: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:26:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57754: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:26:38 dovecot_login authenticator failed for H=(5D1TBl) [178.16.54.22]:51648: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:26:41 dovecot_login authenticator failed for H=(RMlgT9Wf) [178.16.52.139]:50670: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:26:17 dovecot_login authenticator failed for H=(LBnLvWJTKa) [178.16.52.139]:62524: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:26:22 dovecot_login authenticator failed for H=(NWgZIB) [158.94.208.175]:57854: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a7550646b244cb9f2e01cc19c89cfc74bc266022||Title:0xc2799661||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:26:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-01 15:27:56 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:60467: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:27:03 dovecot_login authenticator failed for H=(J4MAhOMaK) [178.16.52.139]:59511: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:27:12 dovecot_login authenticator failed for H=(DYO3Rg0O) [178.16.54.22]:64141: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.142.5
country_id: 1733045
description:
2026-02-01 15:27:06 dovecot_plain authenticator failed for H=(1VT5KO7) [161.142.142.5]:27001: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.245.182
country_id: 337996
description:
2026-02-01 15:27:09 dovecot_plain authenticator failed for H=(56QUULLY) [196.189.245.182]:3364: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:27:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59238: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54582d192ab82dc1fc71409eac08cf7ab9459130||Title:0xf5993745||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:27:02 dovecot_login authenticator failed for H=(W0HtISj) [158.94.208.175]:65528: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.64.158
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:28:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54460: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-02-01 15:28:43 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:52222: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:28:20 dovecot_login authenticator failed for H=(SXPWLK) [158.94.208.175]:57464: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 15:28:27 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:16311: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:59d4186b1c287ad4a9970cdf23ba38d4039851f5||Title:0xb81cedda||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-02-01 15:28:54 dovecot_login authenticator failed for H=([114.202.80.152]) [114.202.80.152]:38883: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:28:08 dovecot_login authenticator failed for H=(924Cbbo) [178.16.54.22]:54881: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 15:28:16 229365 [Warning] Aborted connection 229365 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:28:03 dovecot_login authenticator failed for H=(XS238EUg) [178.16.52.139]:62676: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:28:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33616: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:29:02 dovecot_login authenticator failed for H=(elirNMt) [178.16.52.139]:49658: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:29:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50039: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f9ace5327677c5d454ec9e995797668a7a8297e||Title:0x79b3f184||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:29:26 dovecot_login authenticator failed for H=(I3X2TQ3) [178.16.52.139]:50106: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:29:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-01 15:29:31 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:17376: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:29:32 dovecot_login authenticator failed for H=(5BP16NN) [158.94.208.175]:57092: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 15:29:55 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:34991: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:29:28 dovecot_login authenticator failed for H=(O2B70mP7QG) [178.16.54.22]:62169: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 15:29:59 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:37300: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:30:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 15:30:37 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:48314: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:30:07 dovecot_login authenticator failed for H=(gH6ADM) [178.16.54.22]:63504: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:30:17 dovecot_login authenticator failed for H=(byy3Se) [178.16.52.139]:65155: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 15:30:25 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:57907: 535 Incorrect authentication data


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 15:30:52 229457 [Warning] Aborted connection 229457 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:30:02 dovecot_login authenticator failed for H=(oHG32d) [158.94.208.175]:52642: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 15:30:17 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:22639: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b4dd1a22c770aaf19a7607873b665a4e9b98780||Title:0x92f09e6d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:30:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56620: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 15:30:41 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:45482: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:31:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62155: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:31:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43928: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:31:22 dovecot_login authenticator failed for H=(cqOMTFsB) [158.94.208.175]:62496: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:31:09 dovecot_login authenticator failed for H=(WtiUXQF0H) [178.16.54.22]:57878: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:31:10 dovecot_login authenticator failed for H=(pd0kK71iq) [178.16.52.139]:59701: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:31:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d93adfe6d1b6616737e85c924b5b148339fb8e14||Title:0xcc0ddc77||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:32:08 dovecot_login authenticator failed for H=(UtPwOgyHMa) [178.16.54.22]:60935: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:32:21 dovecot_login authenticator failed for H=(Cy69GA6wLS) [158.94.208.175]:62863: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:32:51 dovecot_login authenticator failed for H=(31IGsdF4Wn) [158.94.208.175]:58340: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.71.154
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=182180 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:32:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65007: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 15:33:01 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:43124: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:32:12 dovecot_login authenticator failed for H=(t9RhER) [178.16.52.139]:57059: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f470cc475408e0f8f7fc385099df1517392b2a42||Title:0xd85217f5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:32:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:33:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55218: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:33:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53949: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:33:20 dovecot_login authenticator failed for H=(2T26kV9) [178.16.52.139]:49296: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:33c2de04df134a566adb9552945a1b02496099a9||Title:0xbbba7db8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2026-02-01 15:33:32 dovecot_login authenticator failed for H=([121.135.188.125]) [121.135.188.125]:32834: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:33:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:33:18 dovecot_login authenticator failed for H=(gTMVXBI) [178.16.54.22]:63465: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2026-02-01 15:33:51 dovecot_login authenticator failed for H=([178.176.229.36]) [178.176.229.36]:38770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:33:16 dovecot_login authenticator failed for H=(H85Bkys) [158.94.208.175]:54124: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.173.114.143
country_id: 2017370
description:
2026-02-01 15:33:25 dovecot_login authenticator failed for H=([85.173.114.143]) [85.173.114.143]:45375: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:27b923ba91eb7a8ca08df33d3c9bda0d4149270d||Title:0xbe6a6f72||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:35:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:34:34 dovecot_login authenticator failed for H=(4phhDWRlQR) [178.16.54.22]:51751: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.3.64.66
country_id: 2017370
description:
2026-02-01 15:34:53 dovecot_login authenticator failed for H=(5x3x64x66.dynamic.ulsk.ertelecom.ru) [5.3.64.66]:46027: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:34:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59383: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:34:06 dovecot_login authenticator failed for H=(QIK3zaT) [158.94.208.175]:56584: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:34:15 dovecot_login authenticator failed for H=(GI9WD8K) [178.16.52.139]:64922: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-02-01 15:34:28 dovecot_login authenticator failed for H=([1.237.155.150]) [1.237.155.150]:34912: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:35:20 dovecot_login authenticator failed for H=(l02mra) [178.16.52.139]:60837: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:35:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57736: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:35:02 dovecot_login authenticator failed for H=(0O8761YA) [178.16.52.139]:52926: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:35:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 15:35:46 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:47913: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:35:07 dovecot_login authenticator failed for H=(lRHiqXETus) [158.94.208.175]:61972: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:35:08 dovecot_login authenticator failed for H=(quxPhQ) [178.16.54.22]:58779: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:35:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54313: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2590ed0d2fe4984dcf51beb42f218654e9cb68f2||Title:0x279915e0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:36:25 dovecot_login authenticator failed for H=(RNAfNrb) [158.94.208.175]:49293: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.238.193.56
country_id: 6252001
description:
[2026-02-01 15:36:32 +0800] info [whostmgrd] 97.238.193.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb50fbff15feb2ffcab24ea7ce07e97b8dc23c6c||Title:0xc4d2fe1e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-02-01 15:36:30 dovecot_plain authenticator failed for H=(einanisly) [75.97.190.237]:50162: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:36:42 dovecot_login authenticator failed for H=(vBwBSQRlS) [178.16.54.22]:54862: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:36:03 dovecot_login authenticator failed for H=(WgihntH) [178.16.52.139]:55842: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:36:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60234: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-01 15:36:27 dovecot_plain authenticator failed for H=(briums) [102.53.15.180]:39669: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 15:36:34 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:49146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:37:14 dovecot_login authenticator failed for H=(bydRcbX) [178.16.54.22]:62972: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:37:21 dovecot_login authenticator failed for H=(f8UTYJig) [158.94.208.175]:59756: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:37:08 dovecot_login authenticator failed for H=(lbDb2Zrp) [178.16.52.139]:58197: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e89379920626fe05b92d31d60e9428e5d16335de||Title:0xabc6a8c2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:37:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:37:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49680: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:37:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42556: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 15:37:23 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:50958: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 15:37:38 dovecot_plain authenticator failed for H=(wzcvm054ywr395oycnfe8r30u1) [136.169.210.16]:57137: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:37:59 dovecot_login authenticator failed for H=(10jTWKdUC) [178.16.52.139]:56860: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 15:37:09 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:56720: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:38:20 dovecot_login authenticator failed for H=(j0LXa8) [178.16.52.139]:54732: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:38:23 dovecot_login authenticator failed for H=(DpaFklfouw) [178.16.54.22]:51266: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 15:38:23 229756 [Warning] Aborted connection 229756 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:38:02 dovecot_login authenticator failed for H=(jcfUbMnE) [158.94.208.175]:56845: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:38:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd9841e81d7d15187215f0cb58f4e2535c31eea8||Title:0x6d151b98||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:38:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56192: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-02-01 15:38:56 dovecot_plain authenticator failed for H=(hicatency) [65.20.133.208]:49056: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:39:07 dovecot_login authenticator failed for H=(b3U9toJsj) [178.16.54.22]:57634: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.155.20.12
country_id: 2802361
description:
2026-02-01 15:39:09 229767 [Warning] Aborted connection 229767 to db: 'unconnected' user: 'unauthenticated' host: '104.155.20.12' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:39:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:39:14 dovecot_login authenticator failed for H=(hF31JBvyYU) [178.16.52.139]:58180: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:39:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62237: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:39:40 dovecot_login authenticator failed for H=(vLF1iZH) [158.94.208.175]:64366: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:39:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50422: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:40:02 dovecot_login authenticator failed for H=(Qd0QIuBx) [178.16.52.139]:58392: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 15:40:23 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:39632: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 15:40:33 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:57624: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:40:04 dovecot_login authenticator failed for H=(bLhfWhOm) [178.16.54.22]:65023: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:40:24 dovecot_login authenticator failed for H=(obLTznGgen) [158.94.208.175]:62539: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:40:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:40:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51344: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:41:07 dovecot_login authenticator failed for H=(ZBzx1JNza) [178.16.52.139]:51719: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:41:13 dovecot_login authenticator failed for H=(fiYkMy) [158.94.208.175]:58428: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-02-01 15:41:17 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:52961: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:41:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56801: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:41:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2026-02-01 15:41:16 dovecot_login authenticator failed for H=([220.178.246.43]) [220.178.246.43]:51533: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:41:19 dovecot_login authenticator failed for H=(Po07Uz) [178.16.54.22]:61519: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:41:22 dovecot_login authenticator failed for H=(53zEMF3Fy5) [178.16.52.139]:58790: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 15:41:31 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:52871: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-02-01 15:41:48 dovecot_login authenticator failed for H=([128.185.119.9]) [125.19.188.98]:34138: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:41:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60526: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:42:14 dovecot_login authenticator failed for H=(6kXMSF7Jlw) [178.16.54.22]:51529: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:42:14 dovecot_login authenticator failed for H=(aWJTbg) [178.16.52.139]:56452: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:42:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55447: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-02-01 15:42:30 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:34586: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:42:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-01 15:42:41 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:35140: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:42:17 dovecot_login authenticator failed for H=(08naokQHoU) [158.94.208.175]:54743: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:44:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41040: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:43:04 dovecot_login authenticator failed for H=(e4z4u5) [158.94.208.175]:57739: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:43:17 dovecot_login authenticator failed for H=(2tRNvpL) [178.16.52.139]:57763: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:43:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61567: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:43:30 dovecot_login authenticator failed for H=(5JNtTX) [178.16.54.22]:60737: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 15:43:58 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:41140: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:44:05 dovecot_login authenticator failed for H=(plpadJnr) [178.16.54.22]:63529: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 15:44:08 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:43146: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:44:08 dovecot_login authenticator failed for H=(HU0Glntp0) [178.16.52.139]:53206: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:44:08 dovecot_login authenticator failed for H=(37ukqMH) [158.94.208.175]:50600: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:44:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50931: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:44:21 dovecot_login authenticator failed for H=(lDfNqq81wr) [178.16.52.139]:57140: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-02-01 15:45:44 dovecot_login authenticator failed for H=([211.63.34.149]) [211.63.34.149]:58793: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:45:05 dovecot_login authenticator failed for H=(GgSZ9L9ux) [178.16.52.139]:50820: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:45:15 dovecot_login authenticator failed for H=(xQLCwr8j9) [158.94.208.175]:53029: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.147.118.174
country_id: 2017370
description:
2026-02-01 15:45:16 dovecot_login authenticator failed for H=([82.147.118.174]) [82.147.118.174]:60418: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:45:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61632: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:45:13 dovecot_login authenticator failed for H=(yrYTFzw) [178.16.54.22]:54647: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 15:46:25 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:38086: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 15:46:57 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:24308: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:46:06 dovecot_login authenticator failed for H=(LXtX5x) [178.16.52.139]:64748: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:46:20 dovecot_login authenticator failed for H=(VJey0C) [178.16.54.22]:53352: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 15:46:44 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:40393: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.187.198
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78001708731070 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:46:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51745: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:46:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39650: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:46:13 dovecot_login authenticator failed for H=(igmJG7) [158.94.208.175]:57506: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:47:21 dovecot_login authenticator failed for H=(oHgJDBZ2) [158.94.208.175]:62205: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.241.153.120
country_id: 1643084
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.100.132
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:47:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57886: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.253.114
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.243.178.22
country_id: 2589581
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:47:32 dovecot_login authenticator failed for H=(wxpwjSuLrm) [178.16.54.22]:51934: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.26
country_id: 1269750
description:
2026-02-01 15:47:08 dovecot_login authenticator failed for H=(nsg-corporate-247.223.187.122.airtel.in) [122.186.202.26]:49738: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.166.224.40
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:47:20 dovecot_login authenticator failed for H=(sLK0BTRmt) [158.94.208.175]:65101: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.54.90
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:47:11 dovecot_login authenticator failed for H=(Ix41rsQMf) [178.16.52.139]:64016: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 15:48:02 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:26614: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:48:07 dovecot_login authenticator failed for H=(p8AQoIPKD) [178.16.52.139]:52701: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:48:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62401: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:48:03 dovecot_login authenticator failed for H=(rkAhRLTU) [178.16.54.22]:60510: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 15:48:55 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:42944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:48:14 dovecot_login authenticator failed for H=(473fmoY) [158.94.208.175]:57507: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:48:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60552: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:49:19 dovecot_login authenticator failed for H=(13rd1efr) [178.16.54.22]:56369: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:49:21 dovecot_login authenticator failed for H=(BZRp0dW) [178.16.52.139]:55491: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:49:23 dovecot_login authenticator failed for H=(UXvUwWcu) [158.94.208.175]:61260: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-02-01 15:49:30 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (thcala) [98.193.112.85]:45730: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-02-01 15:49:34 dovecot_plain authenticator failed for H=(sumbria) [65.20.148.194]:44255: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:49:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62090: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:50:22 dovecot_login authenticator failed for H=(aJVGKq1d) [178.16.52.139]:52457: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 15:50:24 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:34024: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 15:50:32 dovecot_plain authenticator failed for H=(t1dxtdxq9brdj6sgwuxsxhvc8g74be7) [136.169.210.16]:50800: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:50:08 dovecot_login authenticator failed for H=(HhwXeScLM) [158.94.208.175]:54389: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:50:19 dovecot_login authenticator failed for H=(9wip7gE3zq) [178.16.54.22]:51460: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 15:50:40 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:55216: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:50:02 dovecot_login authenticator failed for H=(O9Lc2VV) [178.16.52.139]:54866: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:50:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51733: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:50:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53084: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 15:51:21 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:55944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:51:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57110: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 15:51:08 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:38951: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:51:13 dovecot_login authenticator failed for H=(Hv4bAe9vc) [158.94.208.175]:61758: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:51:03 dovecot_login authenticator failed for H=(FgrcTncdYF) [178.16.52.139]:49634: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:51:16 dovecot_login authenticator failed for H=(Q2sCWiU) [178.16.54.22]:54937: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:52:07 dovecot_login authenticator failed for H=(TpMfzOWYfv) [178.16.52.139]:55201: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:52:18 dovecot_login authenticator failed for H=(2fprfbhC) [158.94.208.175]:64154: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 15:52:29 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:35976: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:52:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62869: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:52:06 dovecot_login authenticator failed for H=(8CukVg0K) [178.16.54.22]:58390: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-02-01 15:52:17 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:59852: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:52:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53424: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:53:22 dovecot_login authenticator failed for H=(7V34g7qqp) [158.94.208.175]:58878: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:53:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62772: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:53:30 dovecot_login authenticator failed for H=(pSPVvR) [178.16.54.22]:60244: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:53:32 dovecot_login authenticator failed for H=(htlz8LqDFo) [178.16.52.139]:57827: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-02-01 15:53:29 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:52889: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:53:06 dovecot_login authenticator failed for H=(rkG7wuX) [178.16.52.139]:57698: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:54:08 dovecot_login authenticator failed for H=(66XPWxfN2) [158.94.208.175]:59153: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-02-01 15:54:59 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:51842: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:54:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52537: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:54:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41398: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:54:04 dovecot_login authenticator failed for H=(SMnSwpMaV) [178.16.54.22]:56684: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:54:07 dovecot_login authenticator failed for H=(PE9sfqu21O) [178.16.52.139]:61724: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.159.90
country_id: 1269750
description:
2026-02-01 15:54:18 dovecot_login authenticator failed for H=([59.93.159.90]) [59.93.159.90]:44767: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:55:09 dovecot_login authenticator failed for H=(5KQ2NGy) [178.16.54.22]:50938: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:55:26 dovecot_login authenticator failed for H=(St0vrEsZn) [158.94.208.175]:61685: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 15:55:13 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:50214: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 15:55:26 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:35911: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:55:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62923: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:55:12 dovecot_login authenticator failed for H=(B3h7ApSvql) [178.16.52.139]:64522: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 15:56:44 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:60911: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:56:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42006: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:56:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52126: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:56:20 dovecot_login authenticator failed for H=(S4wm8XI) [178.16.54.22]:55485: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-01 15:56:36 230321 [Warning] Aborted connection 230321 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-02-01 15:56:36 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:47037: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:56:43 dovecot_login authenticator failed for H=(SGObIacQuJ) [178.16.52.139]:50107: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-01 15:56:52 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:52454: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:56:15 dovecot_login authenticator failed for H=(3pIhDof) [158.94.208.175]:61022: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:56:16 dovecot_login authenticator failed for H=(S7OroPdPc1) [178.16.52.139]:64835: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 15:56:21 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:46628: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.182
country_id: 2635167
description:
2026-02-01 15:57:04 230332 [Warning] Aborted connection 230332 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 15:57:16 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58103: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:57:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65147: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-01 15:57:58 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:28994: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:57:17 dovecot_login authenticator failed for H=(ElW3mtiHMd) [158.94.208.175]:57900: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 15:58:01 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:35420: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 15:57:08 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:33559: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:57:09 dovecot_login authenticator failed for H=(u14RPGgYj) [178.16.52.139]:52219: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 15:57:18 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:45518: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 15:57:07 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:58251: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:57:12 dovecot_login authenticator failed for H=(Kbysrl) [178.16.54.22]:60104: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 15:58:11 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:63991: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 15:58:15 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:47069: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:58:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54614: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-02-01 15:58:23 dovecot_login authenticator failed for H=([121.142.146.166]) [121.142.146.165]:33369: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 15:58:08 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:34140: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:58:14 dovecot_login authenticator failed for H=(MVoRxV6Qj) [178.16.52.139]:60827: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:58:49 dovecot_login authenticator failed for H=(7A108yT4) [178.16.54.22]:52228: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:58:15 dovecot_login authenticator failed for H=(TSx86wgSsO) [158.94.208.175]:63585: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:59:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53746: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:59:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60572: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:59:06 dovecot_login authenticator failed for H=(hyTVme8FPk) [158.94.208.175]:65302: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:59:07 dovecot_login authenticator failed for H=(x6XVfs) [178.16.54.22]:50459: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-01 15:59:14 230393 [Warning] Aborted connection 230393 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:59:18 dovecot_login authenticator failed for H=(PoeoD7Z) [178.16.52.139]:51856: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:00:06 dovecot_login authenticator failed for H=(3118QuhxC) [158.94.208.175]:59016: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:00:07 dovecot_login authenticator failed for H=(tbfyrFR8c8) [178.16.52.139]:59536: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:00:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49894: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:00:23 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:44599: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:00:32 dovecot_login authenticator failed for H=(3A58rKB) [178.16.54.22]:55256: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 16:00:49 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:51248: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:00:55 dovecot_login authenticator failed for H=(uUIhjbV) [158.94.208.175]:50983: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-01 16:01:23 230449 [Warning] Aborted connection 230449 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:01:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61742: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:01:02 dovecot_login authenticator failed for H=(qyUrrCWBo) [178.16.52.139]:51292: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:01:06 dovecot_login authenticator failed for H=(1a0BVmfPih) [178.16.54.22]:51483: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:01:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59144: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:01:17 dovecot_login authenticator failed for H=(rzjg9w) [158.94.208.175]:56230: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:02:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51468: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:02:16 dovecot_login authenticator failed for H=(7yatmR95) [178.16.52.139]:60082: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:02:13 dovecot_login authenticator failed for H=(RsRkJz) [178.16.54.22]:52356: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 16:02:46 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:48852: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:02:06 dovecot_login authenticator failed for H=(PPumH6lj) [158.94.208.175]:64677: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.9
country_id: 1668284
description:
2026-02-01 16:02:18 dovecot_login authenticator failed for H=111-70-32-9.emome-ip.hinet.net [111.70.32.9]:58781: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-02-01 16:02:29 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:42227: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:03:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33172: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:03:11 dovecot_login authenticator failed for H=(eT3gZmd) [178.16.52.139]:51654: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-02-01 16:03:16 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:36100: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-02-01 16:03:49 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:56242: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:03:18 dovecot_login authenticator failed for H=(LJeZLXFl) [158.94.208.175]:61648: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-02-01 16:03:34 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (shiesse) [73.197.194.98]:36228: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 16:03:42 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:14502: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:03:04 dovecot_login authenticator failed for H=(MhFpPEVXIa) [178.16.54.22]:65441: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:03:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56722: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-02-01 16:03:29 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (overai) [73.129.57.71]:33854: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 16:03:31 dovecot_plain authenticator failed for H=(f8rbanenqz906x8ym989vb8g4gnl1ew) [77.40.61.150]:32053: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:04:12 dovecot_login authenticator failed for H=(xBUfthF) [178.16.54.22]:57345: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:04:20 dovecot_plain authenticator failed for H=(rhiock) [64.72.74.162]:48544: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.142.1.173
country_id: 1814991
description:
2026-02-01 16:04:39 dovecot_login authenticator failed for H=([220.189.239.206]) [183.142.1.173]:55004: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
country_id: 6252001
description:
2026-02-01 16:04:50 dovecot_login authenticator failed for H=([166.141.241.229]) [166.141.241.229]:35864: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:04:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.167.46.44
country_id: 6252001
description:
2026-02-01 16:04:15 dovecot_plain authenticator failed for H=c-73-167-46-44.hsd1.ma.comcast.net (hemer) [73.167.46.44]:38686: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.182
country_id: 2635167
description:
2026-02-01 16:04:43 230551 [Warning] Aborted connection 230551 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:04:11 dovecot_login authenticator failed for H=(8anuW0) [158.94.208.175]:59881: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:04:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62753: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:04:29 dovecot_login authenticator failed for H=(swQM0Ytl0z) [158.94.208.175]:65506: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 16:05:03 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:43542: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:05:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53693: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:05:05 dovecot_login authenticator failed for H=(3uuFID02) [158.94.208.175]:62189: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:05:14 dovecot_login authenticator failed for H=(Ydh7z3TeW) [178.16.54.22]:65206: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:05:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:05:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34738: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.182
country_id: 2635167
description:
2026-02-01 16:06:05 230612 [Warning] Aborted connection 230612 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:06:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49341: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:06:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:06:15 dovecot_login authenticator failed for H=(CyE8mok4) [158.94.208.175]:63701: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:06:18 dovecot_login authenticator failed for H=(COtYrkAn) [178.16.54.22]:50325: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 16:07:12 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:50288: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:07:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55245: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.136
country_id: 6252001
description:
2026-02-01 16:07:18 dovecot_login authenticator failed for H=(localhost.localdomain) [124.198.131.136]:65459: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:07:50 dovecot_login authenticator failed for H=(PT2sREf0AB) [158.94.208.175]:65006: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:07:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:07:11 dovecot_login authenticator failed for H=(GqJ6GiiLq2) [158.94.208.175]:58491: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:07:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 16:07:42 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:47296: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:07:43 dovecot_login authenticator failed for H=(AflZeNd9mX) [178.16.54.22]:65398: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:08:09 dovecot_login authenticator failed for H=(O76ou7) [158.94.208.175]:62009: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:08:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60650: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:08:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:08:07 dovecot_login authenticator failed for H=(3dkjOkg) [178.16.54.22]:49227: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:09:20 dovecot_login authenticator failed for H=(MqoREZLE) [158.94.208.175]:58603: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:09:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53475: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.136
country_id: 6252001
description:
2026-02-01 16:09:10 dovecot_login authenticator failed for H=(localhost.localdomain) [124.198.131.136]:64481: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-02-01 16:09:58 dovecot_plain authenticator failed for H=(charchnant) [149.62.239.4]:37820: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:09:12 dovecot_login authenticator failed for H=(rmXmmDoBa) [178.16.54.22]:55212: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2026-02-01 16:10:21 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:57373: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:10:33 dovecot_login authenticator failed for H=(OI4n8w70nL) [178.16.54.22]:53595: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-02-01 16:10:11 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:37326: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:10:13 dovecot_login authenticator failed for H=(A2xHsgKI5) [158.94.208.175]:54843: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:10:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37638: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:10:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60158: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 16:11:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (inone) [87.103.126.54]:5586: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:11:07 dovecot_login authenticator failed for H=(806dzUNyoW) [178.16.54.22]:55368: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:11:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49483: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 16:11:55 dovecot_plain authenticator failed for H=(47gyo7ikun4z135r5) [136.169.210.16]:54552: 535 Incorrect authentication data (set_id=admin@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:11:16 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:57142: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:11:15 dovecot_login authenticator failed for H=(VBg3SOsmM) [158.94.208.175]:62836: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:11:48 dovecot_login authenticator failed for H=(bWYhaC) [158.94.208.175]:56868: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-01 16:11:25 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:48575: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:12:16 dovecot_login authenticator failed for H=(SO25Wd) [178.16.54.22]:56559: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 16:12:40 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:51198: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:12:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38282: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:12:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55587: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:12:05 dovecot_login authenticator failed for H=(0W1nRHuGxm) [158.94.208.175]:56288: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 16:13:10 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:59286: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:13:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63971: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:13:59 dovecot_login authenticator failed for H=(sGboZsbv) [158.94.208.175]:65276: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:13:07 dovecot_login authenticator failed for H=(l7PSahGg) [178.16.54.22]:58911: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.16.74
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:14:18 dovecot_login authenticator failed for H=(6eDBUh4yn0) [178.16.54.22]:62699: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:14:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53503: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:14:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57576: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:14:34 dovecot_login authenticator failed for H=(SQ49Ywt) [158.94.208.175]:57945: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:15:07 dovecot_login authenticator failed for H=(tO5yrS) [178.16.54.22]:53441: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:15:08 dovecot_login authenticator failed for H=(BZ77lGJS) [158.94.208.175]:52015: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:15:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59498: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 16:15:26 dovecot_plain authenticator failed for H=(3nz40zg8923wwulcc) [77.40.61.150]:31983: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.130.168.66
country_id: 1835841
description:
2026-02-01 16:15:54 dovecot_login authenticator failed for H=([118.130.168.66]) [118.130.168.66]:33287: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:16:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65293: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:16:15 dovecot_login authenticator failed for H=(sVrc935x) [158.94.208.175]:63422: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-02-01 16:16:24 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:37168: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:16:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35780: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2026-02-01 16:16:55 dovecot_plain authenticator failed for H=(uptemer) [85.29.149.211]:50034: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.136
country_id: 6252001
description:
2026-02-01 16:16:48 dovecot_login authenticator failed for H=(localhost.localdomain) [124.198.131.136]:52921: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.153.145
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=243858 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:17:49 dovecot_login authenticator failed for H=(lLAbDNX) [158.94.208.175]:51690: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:17:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55935: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-02-01 16:17:31 231008 [Warning] Aborted connection 231008 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:17:34 dovecot_login authenticator failed for H=(gAH8oAxf7k) [178.16.54.22]:63689: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:17:40 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55935: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.54.202
country_id: 6252001
description:
2026-02-01 16:17:01 dovecot_plain authenticator failed for H=cm-72-241-54-202.buckeyecom.net (undys) [72.241.54.202]:53844: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:18:21 dovecot_login authenticator failed for H=(nEL0Nk7Zf) [158.94.208.175]:57318: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:18:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47440: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:18:18 dovecot_login authenticator failed for H=(wXbvLB2G) [178.16.54.22]:55494: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:18:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64456: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2001:4451:bf4:2e00:b4a3:2c62:1e29:8ff2
country_id: 1694008
domain: thinkcloud.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67874.thinkcloud.com.my||ServerName:thinkcloud.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9274c128b0053bf6b0866d1dd1cfaf5f3a7cde7||Title:0x9b267897||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.65.144.39
country_id: 2921044
description:
2026-02-01 16:18:02 dovecot_plain authenticator failed for H=([176.65.144.39]) [176.65.144.39]:62688: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.112.226
country_id: 3865483
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/collageee-3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:19:24 dovecot_login authenticator failed for H=(ajXsW9K) [178.16.54.22]:61021: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:19:02 dovecot_login authenticator failed for H=(KRawotwg6) [158.94.208.175]:49970: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:19:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54079: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:20:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60243: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 16:20:09 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:38034: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:20:13 dovecot_login authenticator failed for H=(qBPvOzbll) [158.94.208.175]:65371: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-02-01 16:20:49 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:44384: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 16:20:20 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:43708: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:20:26 dovecot_login authenticator failed for H=(uzqdX6I4EE) [178.16.54.22]:56197: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:20:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41090: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-02-01 16:21:50 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:21:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55570: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-01 16:21:02 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:32570: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:21:20 dovecot_login authenticator failed for H=(VqTv8JhmT) [158.94.208.175]:58050: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 16:21:20 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:38360: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.44.1.113
country_id: 1814991
description:
2026-02-01 16:21:27 dovecot_login authenticator failed for H=([182.44.1.113]) [182.44.1.113]:57468: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:21:31 dovecot_login authenticator failed for H=(lK5panrX) [178.16.54.22]:60886: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 16:21:10 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:38981: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-02-01 16:21:12 dovecot_login authenticator failed for H=([1.227.228.131]) [1.227.228.131]:36164: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:22:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50099: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-02-01 16:22:55 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50531: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: server.imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/var/www/html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-02-01 16:22:42 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:38622: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 16:23:32 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:44902: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:23:46 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51095: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:23:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52666: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:23:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61341: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:23:42 dovecot_login authenticator failed for H=(YFvBSCdLh) [178.16.54.22]:59513: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 16:23:08 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:9884: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:24:50 dovecot_login authenticator failed for H=(gfQvWb) [178.16.54.22]:49920: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:24:27 dovecot_login authenticator failed for H=(Gr8E1Cgcx) [158.94.208.175]:49860: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:24:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57040: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:25:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58376: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:25:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63185: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:25:24 dovecot_login authenticator failed for H=(3T5dC4upAC) [178.16.54.22]:58909: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.164.226
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-02-01 16:25:08 231268 [Warning] Aborted connection 231268 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:26:02 dovecot_login authenticator failed for H=(RkuNBu6) [158.94.208.175]:50092: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 16:26:31 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:49860: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:26:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52310: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:26:16 dovecot_login authenticator failed for H=(dLpv7hEp) [178.16.54.22]:51926: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.42.82.217
country_id: 6252001
description:
[2026-02-01 16:26:43 +0800] info [whostmgrd] 47.42.82.217 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.54
country_id: 1668284
description:
2026-02-01 16:26:46 dovecot_login authenticator failed for H=111-70-13-54.emome-ip.hinet.net [111.70.13.54]:49476: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:27:27 dovecot_login authenticator failed for H=(jMR26ShQ7B) [178.16.54.22]:57684: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-02-01 16:27:39 231348 [Warning] Aborted connection 231348 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:27:13 dovecot_login authenticator failed for H=(ppmD3XI) [158.94.208.175]:49916: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:27:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58768: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:27:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50272: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:28:20 dovecot_login authenticator failed for H=(DQSqryCHy) [158.94.208.175]:62168: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:28:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:28:43 dovecot_login authenticator failed for H=(kx7XcjAgb) [178.16.54.22]:56482: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:28:47 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 16:29:56 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:44454: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:29:30 dovecot_login authenticator failed for H=(O8NMcaiRyR) [158.94.208.175]:53237: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:29:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55696: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-02-01 16:29:46 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:33402: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:29:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50131: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:29:17 dovecot_login authenticator failed for H=(9FFtfTE4e) [178.16.54.22]:57985: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:30:33 dovecot_login authenticator failed for H=(tsG5QE2) [158.94.208.175]:63061: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:30:46 dovecot_login authenticator failed for H=(dTu2Wyh) [178.16.54.22]:65236: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:30:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55867: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.12.72
country_id: 6252001
description:
[2026-02-01 16:30:10 +0800] info [cpaneld] 103.60.12.72 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 16:30:39 +0800] info [cpaneld] 185.204.54.153 - kednek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kednek (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:31:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61575: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:31:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55916: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:31:50 dovecot_login authenticator failed for H=(gQ81V0Nv) [178.16.54.22]:49225: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.60.7.195
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/speak/18/328/1848970 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:31:07 dovecot_login authenticator failed for H=(W5KfTNCl) [158.94.208.175]:65487: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 16:31:06 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 16:32:38 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:51000: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-01 16:32:23 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:42869: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:32:08 dovecot_login authenticator failed for H=(FyU5lioJ1) [158.94.208.175]:51431: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/project_management.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-01 16:33:02 dovecot_plain authenticator failed for H=(unsfuctro) [12.150.243.22]:48544: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:32:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56693: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.188
country_id: 6252001
description:
2026-02-01 16:33:01 231508 [Warning] Aborted connection 231508 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.188' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:33:12 dovecot_login authenticator failed for H=(RWVPeX3) [178.16.54.22]:55227: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:33:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60382: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 16:33:57 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:58270: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-02-01 16:33:05 dovecot_plain authenticator failed for H=(mayon) [5.32.61.6]:39868: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:33:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61231: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-01 16:33:25 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:54895: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:33:42 dovecot_login authenticator failed for H=(PAFcrRTf) [158.94.208.175]:50275: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:34:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 16:34:11 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49405: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:34:15 dovecot_login authenticator failed for H=(qx1riN09vp) [158.94.208.175]:49741: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:34:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:34:24 dovecot_login authenticator failed for H=(w0wwlj0nmU) [178.16.54.22]:53131: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:35:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57019: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:35:26 dovecot_login authenticator failed for H=(Yq4T7GEK) [158.94.208.175]:56112: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.205.135.110
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/meet/11/718/1153045 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:35:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43882: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:36:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51875: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 16:36:36 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:45314: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 16:37:01 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:37390: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 16:36:10 dovecot_plain authenticator failed for H=(ek17i1kkmmlirvxtr3m) [77.40.61.150]:26781: 535 Incorrect authentication data (set_id=admin@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:36:32 dovecot_login authenticator failed for H=(sgaU11r) [158.94.208.175]:49730: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:37:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57073: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 16:37:23 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:56352: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 16:37:30 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:53482: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 16:37:42 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:54275: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:38:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43860: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:38:06 dovecot_login authenticator failed for H=(QSAJ3b) [158.94.208.175]:62490: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:38:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62415: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.47.16.101
country_id: 1880251
description:
2026-02-01 16:38:22 dovecot_plain authenticator failed for H=(ch33qfq424hsokut7isonrhq5un000db) [101.47.16.101]:40396: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:39:40 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50839: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 16:39:10 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:45980: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:39:13 dovecot_login authenticator failed for H=(KDMR2nN) [158.94.208.175]:53791: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:39:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50839: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:40:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47682: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-02-01 16:40:22 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:33324: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:40:24 dovecot_login authenticator failed for H=(mOPBedM0p) [158.94.208.175]:64670: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.237.57.61
country_id: 2017370
description:
2026-02-01 16:40:39 dovecot_login authenticator failed for H=host-85-237-57-61.dsl.sura.ru [85.237.57.61]:53452: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.70.31
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:40:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57864: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 16:40:07 dovecot_login authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:38130: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-02-01 16:40:23 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:38644: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.186.137
country_id: 2017370
description:
2026-02-01 16:40:33 dovecot_login authenticator failed for H=(p186-137.samaralan.ru) [85.236.186.137]:49606: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.50.171.170
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.217.196
country_id: 1282988
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.76.93.12
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 16:41:03 dovecot_login authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:11671: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.162.98
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 16:41:07 231771 [Warning] Aborted connection 231771 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:41:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63884: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 16:42:35 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:49252: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 16:42:55 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:43396: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 121.200.221.132
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.159.24
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.14.176
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.61.74
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:42:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59360: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.222.59.88
country_id: 3595528
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:42:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54918: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:42:38 dovecot_login authenticator failed for H=(0TOA27) [158.94.208.175]:52503: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:44:00 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:58747: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:43:13 dovecot_login authenticator failed for H=(ebokS9) [158.94.208.175]:51511: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-02-01 16:43:41 231888 [Warning] Aborted connection 231888 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:43:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57226: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.156.225.40
country_id: 2542007
description:
2026-02-01 16:43:06 dovecot_plain authenticator failed for H=([192.168.1.9]) [105.156.225.40]:64642: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:44:49 dovecot_login authenticator failed for H=(5kkddmuB) [158.94.208.175]:64031: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 16:44:08 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:48160: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.182.105
country_id: 1643084
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:44:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63077: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:44:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59450: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:45:20 dovecot_login authenticator failed for H=(JnXsLRch0) [158.94.208.175]:56811: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-02-01 16:45:46 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:50672: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 16:45:21 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:37774: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-02-01 16:45:24 dovecot_login authenticator failed for H=([182.95.25.99]) [182.95.60.146]:51766: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 16:45:35 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:57246: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:45:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58679: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:45:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52830: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:46:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64419: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-02-01 16:46:21 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:33568: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:46:26 dovecot_login authenticator failed for H=(nZNDi8) [158.94.208.175]:57217: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 16:46:02 dovecot_plain authenticator failed for H=(m6qlftiyoemprdiuv) [136.169.210.16]:54737: 535 Incorrect authentication data (set_id=support@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:46:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54060: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2026-02-01 16:46:52 dovecot_login authenticator failed for H=([218.22.187.68]) [218.22.187.66]:36879: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 16:47:12 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:38298: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:47:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54295: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 16:47:43 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:51946: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:47:07 dovecot_login authenticator failed for H=(qnbNoyUYE4) [158.94.208.175]:56184: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:48:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64385: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-02-01 16:48:24 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (imule) [71.235.225.181]:55608: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:48:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51122: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:48:17 dovecot_login authenticator failed for H=(ZQxeyD) [158.94.208.175]:52921: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:49:20 dovecot_login authenticator failed for H=(GQJTUn) [158.94.208.175]:52425: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:49:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50228: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:50:25 dovecot_login authenticator failed for H=(t6oj7NN) [158.94.208.175]:61521: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-02-01 16:50:27 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (tchenopla) [73.230.86.50]:48818: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:50:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62950: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 16:50:17 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:41766: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:50:39 dovecot_login authenticator failed for H=(ChjzYnPJoG) [178.16.54.22]:64171: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 16:50:40 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:35892: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:51:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37912: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:51:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52495: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:51:32 dovecot_login authenticator failed for H=(kA2F7BO) [158.94.208.175]:65028: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:52:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58576: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:52:14 dovecot_login authenticator failed for H=(EB0DFVaIln) [178.16.54.22]:59529: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:52:35 dovecot_login authenticator failed for H=(baPepnRi7X) [158.94.208.175]:57962: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.244.127.191
country_id: 6254930
description:
2026-02-01 16:52:07 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [83.244.127.191]:50910: 535 Incorrect authentication data (set_id=arts@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:53:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53471: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:53:12 dovecot_login authenticator failed for H=(Idx9ngpIy4) [158.94.208.175]:56878: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:53:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51516: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:53:16 dovecot_login authenticator failed for H=(fPlkFWf) [178.16.54.22]:63657: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:54:16 dovecot_login authenticator failed for H=(70n3czwVU0) [158.94.208.175]:49895: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:54:23 dovecot_login authenticator failed for H=(KjnOhhMQ) [178.16.54.22]:62424: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:54:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49755: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 16:54:59 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:63084: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 16:55:48 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:58418: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-02-01 16:56:00 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:40186: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-02-01 16:55:06 dovecot_plain authenticator failed for H=(cottly) [65.20.233.110]:59161: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 16:55:14 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:53832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:55:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55837: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:55:24 dovecot_login authenticator failed for H=(0RPszU) [158.94.208.175]:60973: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:55:31 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55837: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-01 16:55:02 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (boidentost) [68.52.119.193]:34250: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.202.72
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/poor/655/489095 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:55:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59156: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-02-01 16:56:39 dovecot_login authenticator failed for H=(abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:11334: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:56:55 dovecot_login authenticator failed for H=(2UJD83) [158.94.208.175]:55361: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:56:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62124: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2026-02-01 16:56:19 dovecot_login authenticator failed for H=(14.12.168.188.retail.ttk.ru) [188.168.12.14]:57648: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:56:02 dovecot_login authenticator failed for H=(FCluyjpx) [178.16.54.22]:58635: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.163.20
country_id: 1210997
description:
2026-02-01 16:57:16 dovecot_plain authenticator failed for H=(Z69Q27X) [144.48.163.20]:61916: 535 Incorrect authentication data (set_id=eipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:57:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50830: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-02-01 16:57:29 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:46418: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:57:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51995: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 16:57:16 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:57:26 dovecot_login authenticator failed for H=(UU9FHW) [158.94.208.175]:59518: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 16:57:04 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:38398: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:58:33 dovecot_login authenticator failed for H=(2FpLbrD) [178.16.54.22]:54499: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:58:31 dovecot_login authenticator failed for H=(TD0EzDXHm) [158.94.208.175]:53017: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:58:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62664: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:59:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51940: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:59:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48450: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:59:08 dovecot_login authenticator failed for H=(xPWmvZqhWI) [178.16.54.22]:51093: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-02-01 16:59:20 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (hastreify) [174.166.153.20]:54650: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:59:33 dovecot_login authenticator failed for H=(HH9FVifvF) [158.94.208.175]:51252: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:00:14 dovecot_login authenticator failed for H=(mI2RyEiZFf) [178.16.54.22]:58716: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:00:36 dovecot_login authenticator failed for H=(1jCUfR) [158.94.208.175]:54809: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 17:01:01 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:00:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-02-01 17:00:53 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:47779: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 17:01:04 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:50585: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-02-01 17:01:07 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:39246: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:01:45 dovecot_login authenticator failed for H=(glHnRz) [178.16.54.22]:57412: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:01:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35618: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:01:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64610: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:01:08 dovecot_login authenticator failed for H=(q5qKSZhZH) [158.94.208.175]:52733: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.152.157.146
country_id: 3175395
description:
2026-02-01 17:01:18 dovecot_plain authenticator failed for H=(6m13khyus6u3zwjvr5jvb8eul) [5.152.157.146]:54045: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.51.88
country_id: 1562822
description:
2026-02-01 17:01:22 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.51.88]:60304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:02:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54085: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.67.40
country_id: 1694008
description:
2026-02-01 17:02:24 dovecot_plain authenticator failed for H=(Q3OS5) [136.158.67.40]:14322: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 17:02:58 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:58875: 535 Incorrect authentication data (set_id=seanlee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:02:18 dovecot_login authenticator failed for H=(eMVNkp4G) [158.94.208.175]:60962: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 17:02:23 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36592: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:02:23 dovecot_login authenticator failed for H=(3LlKaI1c) [178.16.54.22]:49854: 535 Incorrect authentication data (set_id=fuzz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.15.118
country_id: 192950
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=219&catid=914:smy-dec-2015&id=169:decommissioning-in-malaysia-at-industry-cross-roads&option=com_content&view=article HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 17:03:59 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:48972: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-02-01 17:03:11 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:56064: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:03:21 dovecot_login authenticator failed for H=(40RnxqVc) [158.94.208.175]:64925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:03:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33166: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:03:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56456: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 17:04:02 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:43794: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:03:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:03:28 dovecot_login authenticator failed for H=(kF8nbxDj) [178.16.54.22]:51038: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-02-01 17:03:28 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:53067: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 17:04:18 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:44308: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:04:18 dovecot_login authenticator failed for H=(CoHQYC640) [158.94.208.175]:63671: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:04:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65321: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:04:56 dovecot_login authenticator failed for H=(UBey8oCN8) [178.16.54.22]:65294: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:04:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.102
country_id: 6252001
description:
2026-02-01 17:04:23 232590 [Warning] Aborted connection 232590 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.102' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.112.67
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:04:29 dovecot_login authenticator failed for H=(UhB4jlf0cc) [158.94.208.175]:50679: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.180.212.127
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:35609.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29dba367c1bce14e6265b8f397a8e47f285d6aff||Title:0xcbce0b39||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-02-01 17:04:58 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:40174: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:04:59 dovecot_login authenticator failed for H=(zJiUOJ8HCy) [137.220.199.220]:58406: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.142.83
country_id: 1835841
description:
2026-02-01 17:05:09 dovecot_login authenticator failed for H=([106.245.142.83]) [106.245.142.83]:7367: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-02-01 17:06:01 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (retaunceae) [71.224.169.28]:54862: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:05:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54508: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 139.64.21.172
country_id: 102358
domain: tschuan.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.tschuan.com||ServerName:tschuan.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 17:05:10 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:30932: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:05:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:05:13 dovecot_login authenticator failed for H=(VRZ3t9) [158.94.208.175]:53788: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:05:30 dovecot_login authenticator failed for H=(pGGCGK44vx) [178.16.54.22]:54053: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:05:06 dovecot_login authenticator failed for H=(yNbUBZe3t) [137.220.199.220]:58546: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:06:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36354: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 17:06:32 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:35618: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-02-01 17:06:54 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:34979: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:06:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 17:06:22 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:53884: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:06:24 dovecot_login authenticator failed for H=(NTcWCXkKPT) [178.16.54.22]:63582: 535 Incorrect authentication data (set_id=fuzz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.167.104.215
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=611667 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:06:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60200: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:06:09 dovecot_login authenticator failed for H=(yKfTgSKe4P) [158.94.208.175]:54088: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 17:06:45 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:46282: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:06:10 dovecot_login authenticator failed for H=(N2agsq0Ll) [137.220.199.220]:60637: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:07:03 dovecot_login authenticator failed for H=(DxTwR5tK) [137.220.199.220]:63002: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:07:04 dovecot_login authenticator failed for H=(jQL2k9G) [178.16.54.22]:63195: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:07:05 dovecot_login authenticator failed for H=(B6jq8P) [158.94.208.175]:61576: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2026-02-01 17:07:38 dovecot_login authenticator failed for H=([49.124.151.53]) [49.124.151.53]:39198: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:07:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:07:47 dovecot_login authenticator failed for H=(6l7vlEmM) [137.220.199.220]:49289: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 17:07:54 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:45142: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:07:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63741: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
country_id: 1814991
description:
2026-02-01 17:07:53 dovecot_login authenticator failed for H=([180.168.60.146]) [180.168.60.146]:43629: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:08:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:08:10 dovecot_login authenticator failed for H=(51cL9vF) [158.94.208.175]:62563: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.66.215.139
country_id: 1269750
description:
2026-02-01 17:08:15 dovecot_plain authenticator failed for H=(T8FWR3M6R) [103.66.215.139]:61278: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:08:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51456: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:08:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52168: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:08:28 dovecot_login authenticator failed for H=(aktevd) [137.220.199.220]:51145: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 17:08:05 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:36736: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:08:17 dovecot_login authenticator failed for H=(jnmQI81) [178.16.54.22]:56076: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:08:04 dovecot_login authenticator failed for H=(35Y1fRO) [137.220.199.220]:50121: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.54.163.142
country_id: 357994
description:
2026-02-01 17:09:08 dovecot_plain authenticator failed for H=(ZZ7H17CIG) [197.54.163.142]:60956: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:09:12 dovecot_login authenticator failed for H=(UFF6qZgl) [158.94.208.175]:52259: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:09:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58168: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 17:09:16 dovecot_plain authenticator failed for H=(ijwg6qu2lqaymzdzt78i) [77.40.61.150]:22645: 535 Incorrect authentication data (set_id=support@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:09:20 dovecot_login authenticator failed for H=(5ZAwfdH) [178.16.54.22]:59627: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 40.76.125.17
country_id: 6252001
description:
2026-02-01 17:09:38 232746 [Warning] Aborted connection 232746 to db: 'unconnected' user: 'unauthenticated' host: '40.76.125.17' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.161.25
country_id: 1643084
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_content&view=article&id=169:decommissioning-in-malaysia-at-industry-cross-roads&catid=914:smy-dec-2015&Itemid=219 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.89.31
country_id: 1694008
description:
2026-02-01 17:11:02 dovecot_plain authenticator failed for H=(T8FWR3M6R) [120.29.89.31]:58994: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:10:05 dovecot_login authenticator failed for H=(8qV1F5uWEM) [158.94.208.175]:53290: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:10:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64334: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.110.18
country_id: 3469034
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/photo-collage.png (1).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 17:10:44 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:40522: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.153.16
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/newsletter/687-2/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:11:01 dovecot_login authenticator failed for H=(VBcj8R37x) [178.16.54.22]:56554: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.238.46
country_id: 1269750
description:
2026-02-01 17:10:08 dovecot_plain authenticator failed for H=(1J0G627F) [157.48.238.46]:49887: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:10:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51204: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.250.215
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.14.162
country_id: 248816
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_content&view=article&id=49&Itemid=55 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2026-02-01 17:11:57 dovecot_login authenticator failed for H=([121.189.198.60]) [121.189.198.60]:43536: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.182.10
country_id: 1814991
description:
2026-02-01 17:11:59 dovecot_login authenticator failed for H=([59.46.182.10]) [59.46.182.10]:35681: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.115.5.239
country_id: 953987
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=153&id=94&option=com_content&view=article HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:11:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 17:11:41 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:53852: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.172.163
country_id: 1269750
description:
2026-02-01 17:11:54 dovecot_plain authenticator failed for H=(AM2GM97U1Z7) [152.59.172.163]:56002: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 17:11:59 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:38752: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77093094
abuser: 213.177.179.61
country_id: 1668284
domain: mkmetal.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((40459*43254))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:11:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54594: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-01 17:11:45 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:55470: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:11:08 dovecot_login authenticator failed for H=(Jll5HfSj) [158.94.208.175]:59164: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.89.31
country_id: 1694008
description:
2026-02-01 17:11:08 dovecot_login authenticator failed for H=(T8FWR3M6R) [120.29.89.31]:58994: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:12:04 dovecot_login authenticator failed for H=(5kcqvUQh2Q) [178.16.54.22]:52521: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:12:02 dovecot_login authenticator failed for H=(zOTZ36oi52) [158.94.208.175]:61673: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:12:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50186: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-02-01 17:12:09 dovecot_login authenticator failed for H=(nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:35586: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 17:12:42 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:63396: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:12:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61589: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 17:12:21 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:58822: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:12:20 dovecot_login authenticator failed for H=(JpVshSA) [158.94.208.175]:62523: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:12:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 17:12:23 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:45642: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.66.230
country_id: 895949
description:
2026-02-01 17:13:11 dovecot_plain authenticator failed for H=(CUF28CYXYG583UI9) [165.56.66.230]:2832: 535 Incorrect authentication data (set_id=usman@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:13:24 dovecot_login authenticator failed for H=(BJ1TLu9g) [158.94.208.175]:60620: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 17:13:36 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:54350: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:13:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52917: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 17:13:24 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:36007: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:13:16 dovecot_login authenticator failed for H=(hT5d0Bg) [178.16.54.22]:49452: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:13:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.222.27.84
country_id: 3194884
description:
2026-02-01 17:14:06 dovecot_plain authenticator failed for H=(6LCBR6) [77.222.27.84]:16983: 535 Incorrect authentication data (set_id=yinfun_ng@usfood.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:14:10 dovecot_login authenticator failed for H=(0s2xHOX) [158.94.208.175]:61117: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:14:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58897: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:14:35 dovecot_login authenticator failed for H=(kt68Yw) [178.16.54.22]:64082: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:14:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36788: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:14:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:15:42 dovecot_login authenticator failed for H=(FevwZA) [178.16.54.22]:51670: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:15:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49196: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:15:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 17:15:20 dovecot_login authenticator failed for H=(eYt1350Gq) [158.94.208.110]:63996: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.34.213
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=785897 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.141.169.99
country_id: 2750405
description:
2026-02-01 17:15:38 dovecot_login authenticator failed for H=99.169.141.34.bc.googleusercontent.com (10.164.0.2) [34.141.169.99]:63142: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:15:02 dovecot_login authenticator failed for H=(2rJ930t) [158.94.208.175]:64053: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:16:12 dovecot_login authenticator failed for H=(ZCAKrk) [158.94.208.175]:59613: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:16:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60984: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 17:16:08 dovecot_login authenticator failed for H=(BlxWsSGzK) [158.94.208.110]:55343: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 17:16:43 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:15395: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:16:13 dovecot_login authenticator failed for H=(DZNR24lQ06) [178.16.54.22]:61608: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:16:45 dovecot_login authenticator failed for H=(XYKSzU) [158.94.208.175]:49828: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:17:15 dovecot_login authenticator failed for H=(lvXTPqual) [178.16.54.22]:62761: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2026-02-01 17:17:29 dovecot_login authenticator failed for H=([121.170.218.142]) [121.170.218.142]:41922: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:17:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59496: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 17:17:18 dovecot_login authenticator failed for H=(kuRphyHAh) [158.94.208.110]:50595: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 17:17:48 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:56894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-02-01 17:17:49 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:57717: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:17:07 dovecot_login authenticator failed for H=(htq8xs1Y) [158.94.208.175]:65456: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:17:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50062: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 17:18:06 dovecot_login authenticator failed for H=(eUoAky5) [158.94.208.110]:58405: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:18:26 dovecot_login authenticator failed for H=(gH06g2awQ) [178.16.54.22]:51178: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:18:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65238: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:18:18 dovecot_login authenticator failed for H=(t8NtJBw) [158.94.208.175]:58552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 17:19:54 dovecot_plain authenticator failed for H=(ca605snkfnebzfiutp40mdv) [136.169.210.16]:45293: 535 Incorrect authentication data (set_id=postmaster@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:19:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54763: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:19:19 dovecot_login authenticator failed for H=(DY82haJ) [158.94.208.175]:65085: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:19:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38616: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:19:29 dovecot_login authenticator failed for H=(dPF7T72) [178.16.54.22]:60533: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 17:19:16 dovecot_login authenticator failed for H=(1VvxIgK8T) [158.94.208.110]:53713: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:19:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-02-01 17:19:57 dovecot_plain authenticator failed for H=(andetious) [31.173.2.182]:46414: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:20:02 dovecot_login authenticator failed for H=(wnqY9Hidn) [178.16.54.22]:60438: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 17:20:04 dovecot_login authenticator failed for H=(91HN66) [158.94.208.110]:61501: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.30.55.108
country_id: 1562822
description:
2026-02-01 17:20:14 dovecot_plain authenticator failed for H=(jsb3mjx7xzdawp8ii7sj5728mug8in4) [160.30.55.108]:54544: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:20:45 dovecot_login authenticator failed for H=(TB3NPh) [158.94.208.175]:62137: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 17:20:57 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:33506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:20:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:20:15 dovecot_login authenticator failed for H=(QBadxzG) [158.94.208.175]:55646: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 17:20:47 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:52810: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:20:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60737: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:21:08 dovecot_login authenticator failed for H=(5ammSk9td) [178.16.54.22]:60249: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 17:21:39 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:37094: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:21:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37998: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:21:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56918: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:21:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:21:25 dovecot_login authenticator failed for H=(pgBMpXV) [158.94.208.175]:58179: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 17:21:23 233101 [Warning] Aborted connection 233101 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:22:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62407: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:22:07 dovecot_login authenticator failed for H=(Gl1Azg) [178.16.54.22]:49840: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-01 17:22:15 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:35232: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:22:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:22:17 dovecot_login authenticator failed for H=(8AKfrXgLjl) [158.94.208.175]:58022: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:23:13 dovecot_login authenticator failed for H=(koNdVgTv) [178.16.54.22]:51932: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:23:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35748: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:23:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:23:08 dovecot_login authenticator failed for H=(p1x2FqYY) [158.94.208.175]:65316: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:23:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53661: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:24:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59894: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:24:47 dovecot_login authenticator failed for H=(UIE65B) [178.16.54.22]:64412: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 17:24:16 +0800] info [cpaneld] 185.204.54.153 - doofsirk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user doofsirk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:24:06 dovecot_login authenticator failed for H=(arbQMjQg) [158.94.208.175]:55879: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:25:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55496: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.240.76.170
country_id: 1269750
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_phocagallery&view=category&id=8:prize-award-ceremony-mssacidb-open-ideas-competition-for-students-2017&Itemid=151 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:25:27 dovecot_login authenticator failed for H=(e5lRI1fp) [158.94.208.175]:60813: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:25:33 dovecot_login authenticator failed for H=(0IAvVxju) [158.94.208.175]:49930: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: aire-fresh.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/airefresh/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:26:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61321: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/airefresh/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:26:11 dovecot_login authenticator failed for H=(Ov2Yu6) [158.94.208.175]:59641: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:26:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60630: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-02-01 17:26:15 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:57860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:26:27 dovecot_login authenticator failed for H=(06cF6H) [178.16.54.22]:60800: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 17:26:04 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:47975: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:27:03 dovecot_login authenticator failed for H=(MvQ8Xl) [178.16.54.22]:54405: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:27:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51256: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:27:21 dovecot_login authenticator failed for H=(TI8IVqkCf) [158.94.208.175]:52925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:28:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49824: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:28:03 dovecot_login authenticator failed for H=(klCaXPWDW) [158.94.208.175]:64039: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:28:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56990: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:28:08 dovecot_login authenticator failed for H=(VvOgqNj) [178.16.54.22]:63181: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:28:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:29:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59467: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:29:09 dovecot_login authenticator failed for H=(vhrxuh2V) [158.94.208.175]:60178: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:29:26 dovecot_login authenticator failed for H=(Wi53RZYx2) [158.94.208.175]:65071: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:29:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.255.135
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/photos/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:29:13 dovecot_login authenticator failed for H=(TsKmDRT5C) [178.16.54.22]:63734: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:30:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 17:30:28 +0800] info [cpaneld] 185.204.54.153 - sikaasam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sikaasam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:30:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65446: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:30:53 dovecot_login authenticator failed for H=(xwPIfXQm) [178.16.54.22]:64691: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:30:25 dovecot_login authenticator failed for H=(TBi7XYDEG) [158.94.208.175]:55719: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:31:20 dovecot_login authenticator failed for H=(29lNRCkT) [158.94.208.175]:58287: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:31:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:31:28 dovecot_login authenticator failed for H=(1uYuz9F) [178.16.54.22]:56883: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:31:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55825: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:31:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35008: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:32:28 dovecot_login authenticator failed for H=(7TACBLaI) [178.16.54.22]:55417: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.78.221.23
country_id: 1643084
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/post-14417/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.92.159
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/post-14417/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.97.59.178
country_id: 2589581
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/post-14417/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:32:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62110: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:32:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:32:24 dovecot_login authenticator failed for H=(8MwEBTN) [158.94.208.175]:55376: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.193.126.219
country_id: 1522867
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/post-14417/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:33:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55820: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:33:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49178: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
country_id: 1835841
description:
2026-02-01 17:34:00 dovecot_login authenticator failed for H=([222.236.155.146]) [222.236.155.146]:40128: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:33:05 dovecot_login authenticator failed for H=(a0nej0Q) [178.16.54.22]:55063: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:33:20 dovecot_login authenticator failed for H=(zDUYaM) [158.94.208.175]:61045: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 150.129.89.49
country_id: 1269750
domain: urban.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:51780.urban.my||ServerName:urban.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:560fe40e83f3d57e86178ee3bb377bf964507d4e||Title:0xabbc0801||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.160.117.193
country_id: 1210997
domain: urban.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20208.urban.my||ServerName:urban.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7cf3551b0c1ab5c42f193543f8944de30ed9d027||Title:0xd67b2026||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:34:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54885: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:34:34 dovecot_login authenticator failed for H=(mB8AYyhvA) [137.220.199.220]:58239: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:34:36 dovecot_login authenticator failed for H=(3e5th1re) [158.94.208.175]:50005: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:34:09 dovecot_login authenticator failed for H=(tb8zM54) [158.94.208.175]:56104: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2026-02-01 17:34:12 dovecot_login authenticator failed for H=([49.124.148.192]) [49.124.148.192]:39520: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:35:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60731: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:35:06 dovecot_login authenticator failed for H=(eeyPcK5) [178.16.54.22]:52232: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/keyword/img/photos/press.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:35:05 dovecot_login authenticator failed for H=(0bDS3O0vS) [158.94.208.175]:64904: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:35:09 dovecot_login authenticator failed for H=(02PXoVkjw) [137.220.199.220]:59255: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:35:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50776: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 17:36:46 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:47316: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 17:36:59 233573 [Warning] Aborted connection 233573 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:36:03 dovecot_login authenticator failed for H=(zVp7D9E) [137.220.199.220]:61678: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:36:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50842: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: mkmetal.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/mkmetalc/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/mkmetalc/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:36:28 dovecot_login authenticator failed for H=(zgvh7nIA) [158.94.208.175]:55207: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:37:05 dovecot_login authenticator failed for H=(DrPrOE) [137.220.199.220]:64332: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 17:37:09 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:36601: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:37:18 dovecot_login authenticator failed for H=(bP9d0Na7Ns) [178.16.54.22]:63514: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:37:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63068: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:37:23 dovecot_login authenticator failed for H=(o8t7I8MA) [137.220.199.220]:65213: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:37:27 dovecot_login authenticator failed for H=(hT5YByxOvq) [158.94.208.175]:52677: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:38:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39692: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-02-01 17:38:20 dovecot_login authenticator failed for H=(kLJUdBpBSE) [185.91.69.136]:65230: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:38:15 dovecot_login authenticator failed for H=(E46rQ0M) [137.220.199.220]:51167: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:38:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56847: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.80
country_id: 1733045
description:
2026-02-01 17:38:21 dovecot_login authenticator failed for H=([49.125.201.80]) [49.125.201.80]:36538: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:38:21 dovecot_login authenticator failed for H=(InHP3L8XS) [158.94.208.175]:59894: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-02-01 17:38:33 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.37.23.125.airtelbroadband.in) [125.23.204.74]:38460: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:38:35 dovecot_login authenticator failed for H=(gudfyC79) [178.16.54.22]:50525: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.203
country_id: 1694008
domain: usfood.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95966.usfood.com.my||ServerName:usfood.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9959b73eeec78f0f4251e6fe00cd201295a97be9||Title:0xee4d8eb8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:39:10 dovecot_login authenticator failed for H=(PjVKWpK) [178.16.54.22]:65205: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:39:11 dovecot_login authenticator failed for H=(bl8eGb6C) [158.94.208.175]:60575: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/home/press.php||SC:/home/indfinitydesign/public_html/images/home||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-02-01 17:39:54 233648 [Warning] Aborted connection 233648 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:39:23 dovecot_login authenticator failed for H=(IWa1GWW25T) [137.220.199.220]:54698: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-02-01 17:39:52 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:53024: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:39:59 dovecot_login authenticator failed for H=(NF4alR) [137.220.199.220]:55602: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:39:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63615: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 17:39:34 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:39469: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 17:39:45 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:59185: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:40:01 dovecot_login authenticator failed for H=(32LTXhWfMf) [178.16.54.22]:55515: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 17:40:08 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:46540: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:40:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38168: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:40:17 dovecot_login authenticator failed for H=(2nX7ZAI3Qq) [137.220.199.220]:56420: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/druma/about.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.181.57.107
country_id: 3469034
domain: usfood.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:75960.usfood.com.my||ServerName:usfood.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2786298330505f41f3a2479a8262cc027c4bc1fa||Title:0x88faf96b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:40:04 dovecot_login authenticator failed for H=(K2otHre) [158.94.208.175]:58739: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:40:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53441: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:41:35 dovecot_login authenticator failed for H=(xbxUz2) [178.16.54.22]:50520: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:41:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59533: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:41:39 dovecot_login authenticator failed for H=(kniY8onh6L) [158.94.208.175]:56901: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:41:08 dovecot_login authenticator failed for H=(t6GLqaEj6) [137.220.199.220]:59279: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:42:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44134: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:42:07 dovecot_login authenticator failed for H=(bQA5ngCcaC) [158.94.208.175]:56740: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:42:08 dovecot_login authenticator failed for H=(MXn2A2T) [178.16.54.22]:64556: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:42:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55068: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:42:11 dovecot_login authenticator failed for H=(oPyrMu) [137.220.199.220]:61826: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 17:42:23 dovecot_plain authenticator failed for H=(8xv1281u0r7kxpqp) [77.40.61.150]:29132: 535 Incorrect authentication data (set_id=postmaster@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.207.26
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:43:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60142: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:43:22 dovecot_login authenticator failed for H=(MqF9tOSkN) [137.220.199.220]:64876: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:43:23 dovecot_login authenticator failed for H=(Smvo2k) [178.16.54.22]:53679: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:43:05 dovecot_login authenticator failed for H=(l3WWNCrzhs) [137.220.199.220]:64112: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:43:06 dovecot_login authenticator failed for H=(h9bBxWnWB) [158.94.208.175]:58349: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:44:05 dovecot_login authenticator failed for H=(qGu0Ywpj) [158.94.208.175]:56411: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:44:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49691: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:44:13 dovecot_login authenticator failed for H=(wP4qbspJm) [137.220.199.220]:51482: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:44:20 dovecot_login authenticator failed for H=(AVrYtO31) [178.16.54.22]:64575: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 17:44:38 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:47382: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 17:45:12 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:61352: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2026-02-01 17:45:13 dovecot_login authenticator failed for H=201-61-40-117.bbone.telesp.net.br [201.61.40.117]:39296: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:45:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-01 17:45:34 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:38026: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:45:50 dovecot_login authenticator failed for H=(SVtIcS) [178.16.54.22]:63256: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:45:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48542: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-02-01 17:45:26 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:53040: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.192.250.98
country_id: 1527747
domain: www.astlog.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.astlog.com.my/images/member_logo2.gif HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:45:10 dovecot_login authenticator failed for H=(nM5UDYr) [158.94.208.175]:58430: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:45:45 dovecot_login authenticator failed for H=(dxjT7A) [137.220.199.220]:55764: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:45:07 dovecot_login authenticator failed for H=(q09r85ljH) [137.220.199.220]:53392: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-02-01 17:45:24 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:12936: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 17:45:40 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:37174: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:45:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56473: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:46:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.230.140.143
country_id: 3996063
domain: vc-b.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25086.vc-b.com.my||ServerName:vc-b.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ec09bf4ea3a45d3e2350a3cfd0801ae7ff0aebd||Title:0xe5ff65bb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:46:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51745: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:46:53 dovecot_login authenticator failed for H=(rBpSZh255) [178.16.54.22]:58546: 535 Incorrect authentication data (set_id=fuzz@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:46:09 dovecot_login authenticator failed for H=(QoMKhr3) [137.220.199.220]:56480: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:46:15 dovecot_login authenticator failed for H=(Pkws6gj) [158.94.208.175]:54830: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 17:46:24 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:50072: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-01 17:46:33 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:50456: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 17:46:37 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:36368: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 17:47:05 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56728: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:47:27 dovecot_login authenticator failed for H=(ZGNbhYxoe) [158.94.208.175]:65137: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:47:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58393: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:47:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49010: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:47:02 dovecot_login authenticator failed for H=(5Zzgfdf) [137.220.199.220]:58439: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:48:13 dovecot_login authenticator failed for H=(DheUVH8n) [137.220.199.220]:61698: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:48:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:48:21 dovecot_login authenticator failed for H=(0LhrGXCwPB) [137.220.199.220]:62851: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 17:48:26 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:42120: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.91.3
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99141514886400 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:48:15 dovecot_login authenticator failed for H=(vGeGagr) [158.94.208.175]:65411: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:48:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64464: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 17:48:49 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:57568: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:49:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53976: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:49:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:49:10 dovecot_login authenticator failed for H=(JNexpjlDf) [158.94.208.175]:52276: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-02-01 17:49:51 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:56272: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-02-01 17:50:02 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:35322: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:50:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:50:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57864: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:50:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61507: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:50:05 dovecot_login authenticator failed for H=(8OSYGfj8R) [158.94.208.175]:52505: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:51:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57156: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.31.16
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=24 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:51:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:51:23 dovecot_login authenticator failed for H=(1DMWKJwiTB) [158.94.208.175]:60338: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:51:59 dovecot_login authenticator failed for H=(icvTaxcE) [158.94.208.175]:50145: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-01 17:52:00 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:62101: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:52:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:52:19 dovecot_login authenticator failed for H=(pofSjm6) [158.94.208.175]:58833: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:52:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57422: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-02-01 17:52:58 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:49856: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:52:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63951: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-02-01 17:52:37 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:47080: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-02-01 17:52:50 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:53698: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2026-02-01 17:52:58 dovecot_login authenticator failed for H=([111.171.125.94]) [111.171.125.94]:53217: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:53:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59148: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 17:53:53 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:60991: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 17:53:02 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:55466: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 17:53:21 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:48898: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-02-01 17:53:55 dovecot_login authenticator failed for H=([121.142.146.166]) [121.142.146.165]:46358: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:53:06 dovecot_login authenticator failed for H=(dQBp1P) [158.94.208.175]:56142: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 17:54:22 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:52842: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:54:05 dovecot_login authenticator failed for H=(rHwroy) [158.94.208.175]:56007: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-02-01 17:54:41 234017 [Warning] Aborted connection 234017 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:54:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50020: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
country_id: 1814991
description:
2026-02-01 17:54:05 dovecot_login authenticator failed for H=(113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:36673: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:54:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46046: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 17:54:16 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:39240: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:54:12 dovecot_login authenticator failed for H=(gOpRaB) [178.16.54.22]:63540: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:55:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56092: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:55:14 dovecot_login authenticator failed for H=(D1ImVR) [178.16.54.22]:55118: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:55:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:55:35 dovecot_login authenticator failed for H=(8K4S9ei5) [158.94.208.175]:58057: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:55:03 dovecot_login authenticator failed for H=(QDWWjM) [158.94.208.175]:49944: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 17:55:22 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:40680: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-02-01 17:56:06 234059 [Warning] Aborted connection 234059 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:56:13 dovecot_login authenticator failed for H=(bhiN1u) [158.94.208.175]:49183: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-01 17:56:18 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:56042: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:56:29 dovecot_login authenticator failed for H=(nV02TMdBL) [178.16.54.22]:61262: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:56:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:56:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52471: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 17:56:54 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:47586: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-02-01 17:57:26 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:55170: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 17:57:04 dovecot_plain authenticator failed for H=(2v2hvjaz1t04gse0t) [136.169.210.16]:50672: 535 Incorrect authentication data (set_id=webmaster@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:57:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50396: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:57:21 dovecot_login authenticator failed for H=(Mx7iQqx) [158.94.208.175]:49323: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:57:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 17:57:22 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:50674: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:57:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58653: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 17:57:31 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:37648: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:58:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:58:06 dovecot_login authenticator failed for H=(If2Cu3cI) [178.16.54.22]:57269: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:58:09 dovecot_login authenticator failed for H=(NeRrWk2pS) [158.94.208.175]:55280: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:58:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65032: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:59:14 dovecot_login authenticator failed for H=(52YQLej) [178.16.54.22]:65145: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:59:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:59:04 dovecot_login authenticator failed for H=(aeFpLGJ4ay) [158.94.208.175]:53489: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 17:59:12 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:33970: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:59:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56686: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:59:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61586: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:00:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:00:30 dovecot_login authenticator failed for H=(sl7L0I) [178.16.54.22]:52096: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:00:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50924: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:00:12 dovecot_login authenticator failed for H=(m17wRIrw) [158.94.208.175]:57804: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:01:09 dovecot_login authenticator failed for H=(al2Kq0hODu) [158.94.208.175]:51985: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:01:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62888: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:01:36 dovecot_login authenticator failed for H=(fACcKS7yqR) [178.16.54.22]:65381: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:01:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36684: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.217.34
country_id: 3437598
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/calendar/19/69/1935445 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:02:17 dovecot_login authenticator failed for H=(rYF88NJOC) [178.16.54.22]:57098: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:02:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52511: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:02:22 dovecot_login authenticator failed for H=(TOE3x0EZyE) [158.94.208.175]:53541: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:03:11 dovecot_login authenticator failed for H=(2OyqPI5dv) [158.94.208.175]:64775: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:03:25 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52316: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:03:24 dovecot_login authenticator failed for H=(IsQ5GGve) [158.94.208.175]:51567: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:03:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:03:03 dovecot_login authenticator failed for H=(NUU1KTrwP) [178.16.54.22]:59959: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 18:04:11 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:58636: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:04:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54072: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:04:06 dovecot_login authenticator failed for H=(ABsGkGsr) [158.94.208.175]:57716: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:04:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59702: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-02-01 18:04:29 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:39550: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-01 18:04:45 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:56026: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 18:04:52 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:45616: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:04:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:04:18 dovecot_login authenticator failed for H=(PIZGdvnELI) [178.16.54.22]:62161: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:05:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:05:16 dovecot_login authenticator failed for H=(9NfXyvLpQm) [158.94.208.175]:61963: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.98.239.31
country_id: 953987
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php?category=2K Thinner Series&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:05:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49271: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:05:09 dovecot_login authenticator failed for H=(icV8Xux) [178.16.54.22]:56160: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.10.64.2
country_id: 6252001
domain: webhosting2u.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env/.env.bak||User:webhost||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:06:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 18:06:07 H=([167.148.167.71]) [167.148.167.71]:57009 F=<Server@tujusetia.my> rejected RCPT <layhun.yeoh@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:06:09 dovecot_login authenticator failed for H=(XVBrfq) [158.94.208.175]:54813: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:06:11 dovecot_login authenticator failed for H=(WBxZb7) [178.16.54.22]:51591: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:06:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55618: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:06:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61424: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.213.64
country_id: 1269750
domain: visoft.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77731.visoft.com.my||ServerName:visoft.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d671ec740553df7accf560c3c0b82dff01891c07||Title:0xf5f675f7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:07:18 dovecot_login authenticator failed for H=(dJEVJ3eDYJ) [178.16.54.22]:55512: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:07:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51555: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:07:09 dovecot_login authenticator failed for H=(QfqIykk8SJ) [158.94.208.175]:52954: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-02-01 18:07:15 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:59387: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:07:30 dovecot_login authenticator failed for H=(Y8h8JCWiC) [158.94.208.175]:54783: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 18:07:42 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:54466: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 18:07:47 H=([167.148.167.71]) [167.148.167.71]:64120 F=<Server@tujusetia.my> rejected RCPT <ptsawani@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-02-01 18:07:54 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:37684: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:07:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.244.140
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/history.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:08:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33480: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:08:51 dovecot_login authenticator failed for H=(wV22EsVYz) [178.16.54.22]:52938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:08:18 dovecot_login authenticator failed for H=(lOU5uD0FH) [158.94.208.175]:50914: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:08:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58727: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 18:08:40 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:54968: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 18:09:43 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:36100: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 18:09:06 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:49909: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:09:09 dovecot_login authenticator failed for H=(ouKwj4oF2d) [158.94.208.175]:59768: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-01 18:09:55 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:52802: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:09:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64749: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:09:21 dovecot_login authenticator failed for H=(O0CbADivfX) [178.16.54.22]:56720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 18:09:22 H=([167.148.167.71]) [167.148.167.71]:54424 F=<Server@tujusetia.my> rejected RCPT <syafawatiey@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 18:10:32 H=([167.148.167.71]) [167.148.167.71]:57561 F=<Server@tujusetia.my> rejected RCPT <zainab@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:10:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55218: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:10:18 dovecot_login authenticator failed for H=(oD1HMaJJ3) [158.94.208.175]:55360: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:10:26 dovecot_login authenticator failed for H=(OiuU5Yx28) [178.16.54.22]:64382: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:11:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62011: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:11:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43192: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:11:11 dovecot_login authenticator failed for H=(QPTmX2F1P) [178.16.54.22]:59789: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:11:17 dovecot_login authenticator failed for H=(Tx7mObM) [158.94.208.175]:50434: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:11:23 dovecot_login authenticator failed for H=(03uAug) [158.94.208.175]:59681: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2026-02-01 18:11:15 dovecot_login authenticator failed for H=([218.94.115.164]) [218.94.115.164]:46366: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.13.143
country_id: 1814991
description:
2026-02-01 18:11:41 dovecot_login authenticator failed for H=([39.152.13.143]) [39.152.13.143]:34223: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:13:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:12:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51999: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:12:12 dovecot_login authenticator failed for H=(upE2y2eM) [158.94.208.175]:49196: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:12:22 dovecot_login authenticator failed for H=(JSmTZQ) [178.16.54.22]:61338: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:13:03 dovecot_login authenticator failed for H=(XT8YuM) [158.94.208.175]:59515: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:13:10 dovecot_login authenticator failed for H=(EA7GrJMH) [178.16.54.22]:65093: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.46.179
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/gallery.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:13:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58368: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:13:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59696: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:13:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:14:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50697: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:14:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:14:15 dovecot_login authenticator failed for H=(ykhhC9) [158.94.208.175]:59240: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:14:40 dovecot_login authenticator failed for H=(ae6ufaem) [178.16.54.22]:52183: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:15:20 dovecot_login authenticator failed for H=(NMLqjN) [158.94.208.175]:49388: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 18:15:25 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:37998: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:15:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63537: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:15:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35642: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 18:15:03 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:45960: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:15:19 dovecot_login authenticator failed for H=(F3KAYj) [178.16.54.22]:50024: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:15:03 dovecot_login authenticator failed for H=(ClEnI6M6TQ) [158.94.208.175]:53026: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:15:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.162.19.67
country_id: 690791
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:16:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53442: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:16:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 18:16:26 dovecot_login authenticator failed for H=(JbxLx6d0Q) [178.16.52.139]:61041: 535 Incorrect authentication data (set_id=jsingh.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:16:18 dovecot_login authenticator failed for H=(iIeA1Dv) [178.16.54.22]:53545: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:16:23 dovecot_login authenticator failed for H=(7NNaWW) [158.94.208.175]:55772: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:17:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 18:17:55 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:58760: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-02-01 18:17:28 dovecot_login authenticator failed for H=([218.156.2.230]) [218.156.2.229]:43780: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:17:34 dovecot_login authenticator failed for H=(P62ljXwjQ) [158.94.208.175]:65323: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:17:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56294: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:17:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59486: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 18:17:18 dovecot_login authenticator failed for H=(OBqStO9Nh) [178.16.52.139]:53352: 535 Incorrect authentication data (set_id=jsingh.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 18:17:53 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:56301: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:17:08 dovecot_login authenticator failed for H=(O7dl7v) [178.16.54.22]:51324: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 138.84.73.198
country_id: 1694008
domain: vmsmotorsports.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47098.vmsmotorsports.com.my||ServerName:vmsmotorsports.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e4205580a060a9b64e61c9594f9f5d01bf7aa1dd||Title:0xa3724482||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 18:18:12 dovecot_login authenticator failed for H=(mLtFGcFv) [178.16.52.139]:63908: 535 Incorrect authentication data (set_id=jsingh.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:18:15 dovecot_login authenticator failed for H=(mbQELnws) [178.16.54.22]:65180: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:18:57 dovecot_login authenticator failed for H=(lhAKqL) [158.94.208.175]:58227: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-01 18:18:06 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:50330: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:18:10 dovecot_login authenticator failed for H=(7PaOMn5Ti) [158.94.208.175]:55030: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 18:18:30 dovecot_plain authenticator failed for H=(aljhws1y1besbl17b) [77.40.61.150]:13049: 535 Incorrect authentication data (set_id=webmaster@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:18:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:18:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49153: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:19:18 dovecot_login authenticator failed for H=(JOpxpLihk) [158.94.208.175]:56016: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 109.227.34.75
country_id: 3202326
domain: vtgroupsb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:62193.vtgroupsb.com||ServerName:vtgroupsb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f629fe7f7f7ef2c80da6b686087f4753990837f3||Title:0x17328dd1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:19:05 dovecot_login authenticator failed for H=(HMjRAu) [178.16.54.22]:64179: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:19:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58088: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:19:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 18:19:08 dovecot_login authenticator failed for H=(bm8PxEgiCv) [178.16.52.139]:55231: 535 Incorrect authentication data (set_id=jsingh.vpb@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.200.32.18
country_id: 1694008
domain: vtgroupsb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:61296.vtgroupsb.com||ServerName:vtgroupsb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b98c31af7d1154832cb99d6c1e47d277ba5a0e2||Title:0xdea92241||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:20:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64857: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 18:20:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 18:20:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jsingh.vpb@vc-b.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 18:20:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56852: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:20:06 dovecot_login authenticator failed for H=(eQmTLiXKRW) [158.94.208.175]:60566: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 18:20:28 dovecot_login authenticator failed for H=(D6kARu6LSs) [178.16.52.139]:58382: 535 Incorrect authentication data (set_id=jsingh.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 18:20:29 dovecot_login authenticator failed for H=(MMGITnM1) [178.16.54.22]:56944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 18:20:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 18:20:33 dovecot_login authenticator failed for H=(HXjVfeW) [158.94.208.110]:54538: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 18:21:07 dovecot_login authenticator failed for H=(qApokj) [158.94.208.175]:58049: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 18:21:08 H=([167.148.167.71]) [167.148.167.71]:54826 F=<Server@hmz.com.my> rejected RCPT <account@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 18:21:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54674: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 18:21:17 dovecot_login authenticator failed for H=(QvJLPkva) [178.16.52.139]:55733: 535 Incorrect authentication data (set_id=jsingh.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 18:21:21 dovecot_login authenticator failed for H=(i0fMoy0wvS) [158.94.208.110]:52314: 535 Incorrect authentication data (set_id=kl.tai)


