# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:03:17 dovecot_login authenticator failed for H=(GbQZ9AdXFV) [158.94.208.175]:64781: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:03:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:03:10 dovecot_login authenticator failed for H=(cd2veRRzj) [165.154.217.204]:58601: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 08:04:01 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:48024: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 08:04:47 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:60380: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-02 08:05:00 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:42803: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:04:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55874: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:04:06 dovecot_login authenticator failed for H=(LQPzcvWSQ) [165.154.217.204]:52872: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:04:06 dovecot_login authenticator failed for H=(RcdKP02s) [165.154.235.67]:53373: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 08:04:29 dovecot_login authenticator failed for H=(FkUqkNlgp6) [178.16.54.138]:64443: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:04:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:04:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56727: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:04:25 dovecot_login authenticator failed for H=(e5awO1XRV) [165.154.217.204]:56321: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:04:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 111.119.242.124
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/3-side-seal-bag/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-02-02 08:04:25 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:61937: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:04:28 dovecot_login authenticator failed for H=(VdjQalXQS2) [158.94.208.175]:55944: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:05:02 dovecot_login authenticator failed for H=(309u9DKoPF) [165.154.217.204]:62715: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:05:03 dovecot_login authenticator failed for H=(bM90dyt2) [158.94.208.175]:52132: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:05:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49356: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:05:46 dovecot_login authenticator failed for H=(XoqBJ1h1Zj) [165.154.217.204]:54333: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:05:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:05:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 08:05:03 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:51180: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:05:05 dovecot_login authenticator failed for H=(qSLnj4Ep) [165.154.235.67]:59042: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-02 08:05:17 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:39664: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:06:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:06:02 dovecot_login authenticator failed for H=(5wmTqBj) [165.154.217.204]:58038: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 08:06:26 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:60724: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:06:04 dovecot_login authenticator failed for H=(W0Hj8MTGi) [165.154.235.67]:63874: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.197.11
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=63311523523932 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:06:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59604: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-02-02 08:06:13 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:51880: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:06:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.171.117.66
country_id: 6252001
description:
2026-02-02 08:06:51 dovecot_login authenticator failed for H=c-67-171-117-66.hsd1.ut.comcast.net ([127.0.0.1]) [67.171.117.66]:36710: 535 Incorrect authentication data (set_id=info@santanmas.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 08:06:26 dovecot_login authenticator failed for H=(Xkb2CYBOfh) [178.16.54.138]:59464: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:06:39 dovecot_login authenticator failed for H=(YkihXk) [158.94.208.175]:60153: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:07:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:07:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59048: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:07:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 08:07:26 dovecot_login authenticator failed for H=(MsfBH8f) [178.16.54.138]:60508: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:07:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52262: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-02-02 08:07:09 dovecot_plain authenticator failed for H=(militizers) [31.173.2.182]:30700: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:07:11 dovecot_login authenticator failed for H=(4IfSMiq) [158.94.208.175]:59592: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:07:01 dovecot_login authenticator failed for H=(JkPQcy) [165.154.217.204]:53989: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:07:04 dovecot_login authenticator failed for H=(eWy9swQE) [165.154.235.67]:52701: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:07:17 dovecot_login authenticator failed for H=(HfOGksEhH3) [165.154.217.204]:57215: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 44.220.188.90
country_id: 6252001
description:
Feb  2 08:07:17 sv3 pure-ftpd[1530871]: (?@44.220.188.90) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.71.250
country_id: 3895114
description:
2026-02-02 08:07:28 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [186.189.71.250]:51157: 535 Incorrect authentication data (set_id=tiong@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:08:20 dovecot_login authenticator failed for H=(e5KEeDhHIe) [158.94.208.175]:61074: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-02 08:08:24 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:62058: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 08:08:26 dovecot_login authenticator failed for H=(ZijrCePYdS) [178.16.54.138]:54058: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:08:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:08:12 dovecot_login authenticator failed for H=(F7qij8gdB) [165.154.217.204]:53565: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:08:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60953: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:08:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:08:04 dovecot_login authenticator failed for H=(VPGpKup) [165.154.235.67]:57800: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-02 08:08:07 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:33391: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:08:31 dovecot_login authenticator failed for H=(2swF5K) [158.94.208.110]:49346: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:08:49 dovecot_login authenticator failed for H=(s33SAAtX) [165.154.217.204]:61788: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 08:08:57 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:46178: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:09:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:09:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54910: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-02-02 08:09:18 +0800] info [webmaild] 180.75.72.60 - - "GET /apple-touch-icon.png HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:09:19 dovecot_login authenticator failed for H=(JAdaC7Fef) [158.94.208.110]:57110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 08:09:20 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:34266: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:09:23 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53445: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:09:23 dovecot_login authenticator failed for H=(FMPzJz450) [158.94.208.175]:50479: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-02 08:09:36 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:43033: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:09:04 dovecot_login authenticator failed for H=(gDZv6npyu) [165.154.235.67]:62054: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:09:08 dovecot_login authenticator failed for H=(sK5KJyFIgs) [165.154.217.204]:49258: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:10:06 dovecot_login authenticator failed for H=(xao9e93f7) [165.154.235.67]:50513: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:10:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.9.19.90
country_id: 2782113
description:
[2026-02-02 08:10:37 +0800] info [webmaild] 185.9.19.90 - takao-nakashima@mckd.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:10:13 dovecot_login authenticator failed for H=(VTB59AUU) [165.154.217.204]:63091: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:10:29 dovecot_login authenticator failed for H=(JaKlRhHdi) [158.94.208.110]:52410: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-02-02 08:10:32 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:44073: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 08:10:51 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:34535: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:10:59 dovecot_login authenticator failed for H=(j9Xwyyr3E) [165.154.254.163]:56449: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.19.241
country_id: 2017370
description:
2026-02-02 08:10:50 dovecot_plain authenticator failed for H=(glaugeal) [195.239.19.241]:36142: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:10:06 dovecot_login authenticator failed for H=(UDW8XmQNG) [165.154.217.204]:61383: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:10:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62373: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:10:36 dovecot_login authenticator failed for H=(Tqde5p) [158.94.208.175]:59883: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.253.131.3
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category&sub=Fun Clear HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.82.181
country_id: 1880251
description:
Feb  2 08:11:26 sv3 pure-ftpd[1534139]: (?@146.190.82.181) [INFO] New connection from 146.190.82.181


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:11:46 dovecot_login authenticator failed for H=(zol03yK) [165.154.217.204]:49876: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 08:11:07 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:27074: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:11:08 dovecot_login authenticator failed for H=(jGX1RsopJW) [158.94.208.175]:58606: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:11:02 dovecot_login authenticator failed for H=(Jk1UAmeCd) [165.154.217.204]:57349: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:11:07 dovecot_login authenticator failed for H=(QCvqeM) [165.154.254.163]:58139: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:11:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54419: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:11:17 dovecot_login authenticator failed for H=(yWxJ0q) [158.94.208.110]:60110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:11:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39374: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:11:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.82.181
country_id: 1880251
description:
Feb  2 08:11:30 sv3 pure-ftpd[1534139]: (?@146.190.82.181) [WARNING] Authentication failed for user [autodiscover]


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-02  8:11:54 275587 [Warning] Aborted connection 275587 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:11:06 dovecot_login authenticator failed for H=(kQ7DL2GHHr) [165.154.235.67]:54728: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:12:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51074: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:12:16 dovecot_login authenticator failed for H=(atCmrwnGhO) [165.154.254.163]:60613: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 38.242.131.121
country_id: 3017382
domain: acburn.com.my
description:
IM360 WAF: Hidden file access||RSV:7.71||T:APACHE||QS:url=https%3A%2F%2Fstorage.googleapisattacker.com%2Fgpt-engineer-scr||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:12:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:12:07 dovecot_login authenticator failed for H=(hGlVKesRj) [165.154.235.67]:59175: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:12:12 dovecot_login authenticator failed for H=(UKbkxr4j) [158.94.208.175]:50948: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:12:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:12:28 dovecot_login authenticator failed for H=(vqI8fScU) [158.94.208.110]:55394: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 08:12:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:12:04 dovecot_login authenticator failed for H=(v7xZEDJNu) [165.154.217.204]:53707: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:13:07 dovecot_login authenticator failed for H=(deO8aF9t) [165.154.235.67]:63352: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:13:14 dovecot_login authenticator failed for H=(EweY0vi) [165.154.254.163]:62789: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:13:16 dovecot_login authenticator failed for H=(A6epQ4S) [158.94.208.110]:63660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:13:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49222: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:13:02 dovecot_login authenticator failed for H=(hBIgCZRLA) [165.154.217.204]:65391: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:13:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 08:13:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:13:14 dovecot_login authenticator failed for H=(Llvqvd) [165.154.217.204]:51378: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:13:17 dovecot_login authenticator failed for H=(E5mURX) [158.94.208.175]:51700: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:13:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:13:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61678: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:13:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:14:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54930: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:14:13 dovecot_login authenticator failed for H=(O0e5Cg2Etb) [165.154.254.163]:49626: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 08:14:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:14:21 dovecot_login authenticator failed for H=(LZVAiEExbK) [158.94.208.175]:57341: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:14:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:14:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:14:06 dovecot_login authenticator failed for H=(bw8mIJLP6) [165.154.235.67]:50999: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:14:10 dovecot_login authenticator failed for H=(uUXNedTANh) [165.154.217.204]:62307: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:14:38 dovecot_login authenticator failed for H=(NMT9ibJXK) [165.154.217.204]:51322: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:14:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:14:26 dovecot_login authenticator failed for H=(rDXObnB) [158.94.208.110]:59368: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:15:14 dovecot_login authenticator failed for H=(NefgfN8) [158.94.208.110]:50785: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:15:23 dovecot_login authenticator failed for H=(fdzsjLFr) [158.94.208.175]:55880: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:15:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56301: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:15:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:15:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 08:15:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:15:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36468: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:15:06 dovecot_login authenticator failed for H=(ADY7ZEM) [165.154.235.67]:55211: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:15:09 dovecot_login authenticator failed for H=(ebT7ACSL) [165.154.217.204]:56950: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.31
country_id: 1643084
description:
[2026-02-02 08:15:49 +0800] info [cpaneld] 95.135.93.31 - eeyh@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:15:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:15:11 dovecot_login authenticator failed for H=(8oncIAI) [165.154.254.163]:52383: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-02 08:16:28 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:53094: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:16:05 dovecot_login authenticator failed for H=(KTKHDlOAgD) [165.154.217.204]:50955: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:16:12 dovecot_login authenticator failed for H=(z7dqjhD1Y) [165.154.217.204]:52298: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-02 08:16:17 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:41374: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:16:33 dovecot_login authenticator failed for H=(Vrggne4) [158.94.208.175]:63724: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-02 08:16:32 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:59918: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:16:05 dovecot_login authenticator failed for H=(KKng1kJ3M) [165.154.235.67]:59735: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:16:09 dovecot_login authenticator failed for H=(0b9eDM1I) [165.154.254.163]:54788: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 08:16:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:16:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55890: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:16:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:16:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 08:16:18 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:48579: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:17:40 dovecot_login authenticator failed for H=(r2z9vMQp) [165.154.217.204]:51946: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:17:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42038: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:17:05 dovecot_login authenticator failed for H=(S7pqxQ) [165.154.235.67]:65392: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:17:09 dovecot_login authenticator failed for H=(3lhwfORP) [165.154.254.163]:58097: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:17:02 dovecot_login authenticator failed for H=(2seDUjU) [165.154.217.204]:61537: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:17:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65529: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:17:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:17:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:17:06 dovecot_login authenticator failed for H=(ZJ1L9Utql) [158.94.208.175]:57855: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:18:48 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57889: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 08:18:08 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:34710: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:18:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:18:16 dovecot_login authenticator failed for H=(x3nB1uZX) [158.94.208.175]:61346: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:18:05 dovecot_login authenticator failed for H=(b3Nwy7WNz9) [165.154.235.67]:53490: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-02-02 08:18:28 dovecot_login authenticator failed for H=([200.164.226.113]) [200.149.213.242]:35917: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:18:10 dovecot_login authenticator failed for H=(zEdxn7O) [165.154.254.163]:61325: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.61.146
country_id: 1814991
description:
2026-02-02 08:18:14 dovecot_login authenticator failed for H=([120.198.61.146]) [120.198.61.146]:54406: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:18:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-02-02 08:18:22 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:21920: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:18:06 dovecot_login authenticator failed for H=(OA26y9) [165.154.217.204]:56961: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:19:02 dovecot_login authenticator failed for H=(yeBTcJMB) [165.154.217.204]:51191: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:19:04 dovecot_login authenticator failed for H=(UsSUajB4M) [165.154.217.204]:51582: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:19:06 dovecot_login authenticator failed for H=(C9TZhsYCU) [165.154.235.67]:58064: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:19:20 dovecot_login authenticator failed for H=(pQGRaKzJ) [158.94.208.175]:62442: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:19:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57889: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:19:08 dovecot_login authenticator failed for H=(gITl37RvhP) [165.154.254.163]:65294: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 08:19:44 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:42434: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-02-02 08:19:37 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (trapoppite) [73.197.236.163]:58622: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:20:07 dovecot_login authenticator failed for H=(kuq33PRKT5) [165.154.235.67]:62699: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:20:12 dovecot_login authenticator failed for H=(Fbrvel6FzP) [165.154.217.204]:63881: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:20:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60237: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:20:37 dovecot_login authenticator failed for H=(t5f9Rsi4F) [165.154.217.204]:51949: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:20:06 dovecot_login authenticator failed for H=(tgFp0nuB) [165.154.254.163]:55177: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:20:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:20:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39000: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:20:31 dovecot_login authenticator failed for H=(On8R4NVj72) [158.94.208.175]:57427: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 08:20:07 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:27728: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 08:21:14 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:26706: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:21:03 dovecot_login authenticator failed for H=(tnzYeEg) [165.154.254.163]:55859: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.125.142
country_id: 1269750
description:
2026-02-02 08:21:04 dovecot_login authenticator failed for H=([117.206.125.142]) [117.206.125.142]:45838: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:21:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2026-02-02 08:21:59 dovecot_login authenticator failed for H=([178.176.229.36]) [178.176.229.36]:50204: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:21:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:21:09 dovecot_login authenticator failed for H=(SKkm83) [165.154.217.204]:57754: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:21:11 dovecot_login authenticator failed for H=(TCkIDuH42) [158.94.208.175]:61491: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-02  8:21:36 275864 [Warning] Aborted connection 275864 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2026-02-02 08:21:51 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:58444: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:21:05 dovecot_login authenticator failed for H=(TMMRyGO) [165.154.235.67]:50538: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:21:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57307: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:22:10 dovecot_login authenticator failed for H=(mCZ7Au6) [165.154.217.204]:53099: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.210.73
country_id: 2750405
description:
2026-02-02 08:22:13 H=([158.94.210.73]) [158.94.210.73]:51398 F=<no-reply@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:22:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:22:19 dovecot_login authenticator failed for H=(DINE4Dq) [165.154.254.163]:50432: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 08:22:41 dovecot_login authenticator failed for H=(h5w7QioR9f) [69.5.189.21]:64859: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:22:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:22:05 dovecot_login authenticator failed for H=(KImM7YyNJ) [165.154.217.204]:52123: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:22:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45324: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:22:16 dovecot_login authenticator failed for H=(6t72Wb) [158.94.208.175]:55050: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:22:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52370: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.241.163.199
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Chart/Axis.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:22:04 dovecot_login authenticator failed for H=(TrCjFoO) [165.154.235.67]:55254: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:23:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-02-02 08:23:57 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:52304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:23:03 dovecot_login authenticator failed for H=(lvU3Is) [165.154.235.67]:60242: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:23:10 dovecot_login authenticator failed for H=(kCo4j2sZ0) [165.154.217.204]:65183: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-02-02 08:23:16 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:52537: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-02-02  8:23:42 275971 [Warning] Aborted connection 275971 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.128.183.250
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/monolog/monolog/src/Monolog/Handler/MissingExtensionException.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:23:16 dovecot_login authenticator failed for H=(aUQY6aUA) [165.154.254.163]:52967: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:23:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:23:26 dovecot_login authenticator failed for H=(8udXb9) [158.94.208.175]:61057: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:23:31 dovecot_login authenticator failed for H=(qpJtX9) [165.154.217.204]:53079: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 08:23:05 dovecot_login authenticator failed for H=(7I4rYk) [69.5.189.21]:52398: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:23:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56430: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:23:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:24:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35674: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-02 08:24:45 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:54718: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-02-02 08:24:53 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:60788: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:24:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:24:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65511: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2026-02-02 08:24:13 dovecot_login authenticator failed for H=([50.217.255.171]) [50.217.255.171]:35600: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 08:24:28 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:52852: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-02 08:24:41 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:60776: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:24:03 dovecot_login authenticator failed for H=(eCzLk4av) [165.154.235.67]:65047: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:24:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:24:14 dovecot_login authenticator failed for H=(wX4M3dWY) [165.154.254.163]:54431: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:24:31 dovecot_login authenticator failed for H=(ZtoVLJ) [158.94.208.175]:64688: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-02-02  8:24:26 276011 [Warning] Aborted connection 276011 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.155.166
country_id: 1269750
description:
2026-02-02 08:24:52 dovecot_plain authenticator failed for H=(z3rfi48uxlz7dgd3f) [59.93.155.166]:47175: 535 Incorrect authentication data (set_id=vincent.chong@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:24:08 dovecot_login authenticator failed for H=(0JIgybmfs3) [165.154.217.204]:60133: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:24:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:25:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:25:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:25:05 dovecot_login authenticator failed for H=(0UAsLP) [158.94.208.175]:57840: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:25:06 dovecot_login authenticator failed for H=(MOGW65p) [165.154.217.204]:55206: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:25:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:25:21 dovecot_login authenticator failed for H=(5ZcjpRO) [165.154.235.67]:54567: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:25:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56816: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:25:05 dovecot_login authenticator failed for H=(6UDKUDG) [165.154.217.204]:54986: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:25:12 dovecot_login authenticator failed for H=(dTh8xK5zs) [165.154.254.163]:61485: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 08:26:03 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:50045: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:26:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2026-02-02 08:26:54 dovecot_login authenticator failed for H=177-72-87-7.static.as262543.net.br [177.72.87.7]:40846: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:26:03 dovecot_login authenticator failed for H=(IRDtCS) [165.154.217.204]:50095: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:26:10 dovecot_login authenticator failed for H=(jOwWiAj5M) [165.154.254.163]:58735: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 08:26:21 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:58763: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:26:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36614: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:26:44 dovecot_login authenticator failed for H=(HA5U25) [158.94.208.175]:58427: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:26:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:26:31 dovecot_login authenticator failed for H=(lmSmJmu) [165.154.217.204]:56126: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-02-02 08:26:45 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:38742: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:26:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:26:21 dovecot_login authenticator failed for H=(nYZmiD5u) [165.154.235.67]:52453: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:26:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56714: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:27:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:27:18 dovecot_login authenticator failed for H=(g1OrBm) [165.154.235.67]:59658: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:27:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65502: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 08:27:24 H=(localhost.localdomain) [78.153.140.207]:54460 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:27:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:27:09 dovecot_login authenticator failed for H=(jTbcNb) [165.154.217.204]:64483: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:27:09 dovecot_login authenticator failed for H=(daT8gz73mw) [165.154.254.163]:54889: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:28:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:28:06 dovecot_login authenticator failed for H=(bsAg2a) [165.154.254.163]:65273: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:28:05 dovecot_login authenticator failed for H=(xMu2uMhrd) [165.154.217.204]:59915: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:28:19 dovecot_login authenticator failed for H=(jyqy4D) [165.154.235.67]:65329: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:28:23 dovecot_login authenticator failed for H=(yQor4id) [165.154.217.204]:63612: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-02-02 08:28:37 dovecot_login authenticator failed for H=([167.250.118.53]) [167.250.118.53]:35778: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 08:29:01 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:39608: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:28:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57186: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:28:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60100: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.137.151.93
country_id: 1814991
description:
2026-02-02 08:28:49 dovecot_login authenticator failed for H=([180.137.151.93]) [180.137.151.93]:49627: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:28:09 dovecot_login authenticator failed for H=(Gcy2xHitrN) [158.94.208.175]:60391: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 08:28:46 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:36874: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: dsc-expat.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/537.26||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:29:53 dovecot_login authenticator failed for H=(N6TgqB) [158.94.208.175]:62569: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:29:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:29:10 dovecot_login authenticator failed for H=(VeohJNyFna) [165.154.217.204]:56514: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 08:29:52 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:59936: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.134.67
country_id: 1269750
description:
2026-02-02 08:30:00 dovecot_plain authenticator failed for H=(qaldnhi5o79qt4lfdunrxawwrmo88ga1) [117.247.134.67]:54665: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:29:06 dovecot_login authenticator failed for H=(t6c7MhhiQ8) [165.154.254.163]:63629: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:29:21 dovecot_login authenticator failed for H=(MNrS3FY) [165.154.235.67]:54289: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 08:29:41 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58680: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-02-02 08:29:58 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:43552: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:30:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:29:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55892: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 08:29:21 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:20054: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 08:30:09 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:59040: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:30:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:30:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:30:35 dovecot_login authenticator failed for H=(39GxFzYUkC) [165.154.217.204]:59696: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:30:25 dovecot_login authenticator failed for H=(12OgsuOQ) [158.94.208.175]:61784: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:30:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33722: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:30:20 dovecot_login authenticator failed for H=(5htb2QoKY) [165.154.235.67]:56648: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 62.106.66.16
country_id: 2750405
domain: maalloys.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/85.0.4182.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:30:15 dovecot_login authenticator failed for H=(omY9pOWL3x) [165.154.217.204]:56647: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 08:30:44 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:53758: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:30:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49456: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:30:03 dovecot_login authenticator failed for H=(v60xiEWr) [165.154.254.163]:58434: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 08:30:31 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:51694: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 08:31:06 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.215.35
country_id: 3378535
description:
2026-02-02 08:31:12 dovecot_plain authenticator failed for H=35.215.108.190-cust.enetworksgy.com (L7V1JJ7) [190.108.215.35]:52100: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:31:01 dovecot_login authenticator failed for H=(KeCEow) [165.154.254.163]:57222: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:31:14 dovecot_login authenticator failed for H=(JOrV9a3QO7) [165.154.217.204]:51022: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 08:31:15 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:43369: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:31:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:31:19 dovecot_login authenticator failed for H=(6bGdUS8IB) [165.154.235.67]:60867: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:31:29 dovecot_login authenticator failed for H=(RGAaU3t0CZ) [158.94.208.175]:49638: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:31:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49264: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 08:31:44 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:18714: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.196.211
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263803 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:31:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-02-02 08:32:12 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:52424: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-02-02 08:32:26 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:40454: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:32:11 dovecot_login authenticator failed for H=(TYhpW0TAre) [165.154.217.204]:49753: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:32:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:32:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:32:19 dovecot_login authenticator failed for H=(iE7oDVM) [165.154.235.67]:49801: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:32:50 dovecot_login authenticator failed for H=(GpTICjuu) [165.154.217.204]:59558: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:32:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59292: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:32:17 dovecot_login authenticator failed for H=(J7ahfEdkY) [165.154.254.163]:59591: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:32:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57993: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:32:33 dovecot_login authenticator failed for H=(DXJK6c) [158.94.208.175]:57854: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-02-02 08:32:48 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:12975: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.249.184.79
country_id: 630336
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/File/UploadedFileTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:33:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:33:09 dovecot_login authenticator failed for H=(425T54Qodq) [165.154.217.204]:64068: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:33:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58705: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 121.122.111.69
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:33:06 dovecot_login authenticator failed for H=(I86geWCkP) [158.94.208.175]:54767: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 08:33:13 +0800] info [cpaneld] 185.204.54.153 - ollaam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ollaam (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:33:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:33:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:33:18 dovecot_login authenticator failed for H=(HfSFgZ5) [165.154.235.67]:55032: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:33:15 dovecot_login authenticator failed for H=(0G78330Sh) [165.154.254.163]:60844: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 08:34:53 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:35250: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-02-02 08:34:04 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (ammegae) [73.208.81.125]:36056: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:34:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:34:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:34:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 08:34:43 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:56944: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:34:07 dovecot_login authenticator failed for H=(NKIRCG1N) [165.154.217.204]:60506: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:34:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53117: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:34:13 dovecot_login authenticator failed for H=(Wdo93v2) [165.154.254.163]:62148: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:34:16 dovecot_login authenticator failed for H=(Gnol7B6dDB) [165.154.235.67]:59349: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:35:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:35:03 dovecot_login authenticator failed for H=(4L4PV0) [165.154.217.204]:56782: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.210.73
country_id: 2750405
description:
2026-02-02 08:35:03 H=([158.94.210.73]) [158.94.210.73]:51985 F=<no-reply@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:35:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:35:18 dovecot_login authenticator failed for H=(hIBlmqj) [165.154.235.67]:64084: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:35:10 dovecot_login authenticator failed for H=(6HVQDCc) [158.94.208.175]:53390: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:35:12 dovecot_login authenticator failed for H=(VO0Om2l) [165.154.254.163]:53578: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:35:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36750: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:35:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65247: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.208
country_id: 6252001
description:
2026-02-02  8:35:16 276468 [Warning] Aborted connection 276468 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.208' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:35:05 dovecot_login authenticator failed for H=(BsTsmEWO) [165.154.217.204]:57281: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:36:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58515: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:36:16 dovecot_login authenticator failed for H=(OaWAFH) [165.154.235.67]:51712: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:36:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-02-02 08:36:36 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (hydragy) [68.60.77.128]:36932: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:36:11 dovecot_login authenticator failed for H=(8OIQpB8) [158.94.208.175]:60627: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:36:03 dovecot_login authenticator failed for H=(t3zjkII3) [165.154.217.204]:62417: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:36:10 dovecot_login authenticator failed for H=(0IuPHiyFeb) [165.154.254.163]:54317: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:37:47 dovecot_login authenticator failed for H=(k2UinHFSdd) [158.94.208.175]:52966: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:37:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:37:17 dovecot_login authenticator failed for H=(ZNMbB8) [165.154.235.67]:55910: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:37:08 dovecot_login authenticator failed for H=(hT4Y2QL) [165.154.254.163]:58939: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:37:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50334: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:37:17 dovecot_login authenticator failed for H=(09aUFRi) [165.154.217.204]:54910: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:37:19 dovecot_login authenticator failed for H=(1ZFAzTl3) [165.154.217.204]:55314: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:37:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53259: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.116
country_id: 6252001
description:
Feb  2 08:38:43 sv3 pure-ftpd[1558083]: (?@66.240.236.116) [INFO] New connection from 66.240.236.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:38:51 dovecot_login authenticator failed for H=(6pmpQ9SQ) [158.94.208.175]:49198: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:38:07 dovecot_login authenticator failed for H=(Bgv0tgIFJ) [165.154.254.163]:59562: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-02-02 08:38:22 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:33894: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 08:38:56 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:50143: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:38:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:38:16 dovecot_login authenticator failed for H=(yI8N6Ttram) [165.154.235.67]:60193: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-02-02 08:38:35 dovecot_plain authenticator failed for H=(suran) [65.20.250.163]:39210: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:38:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.86.55
country_id: 1814991
description:
2026-02-02 08:38:08 dovecot_login authenticator failed for H=([14.20.86.55]) [14.20.86.55]:50557: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:38:15 dovecot_login authenticator failed for H=(LwYsgV) [165.154.217.204]:53786: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-02-02 08:38:32 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (prous) [76.97.155.25]:40204: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 08:38:36 dovecot_plain authenticator failed for H=(stents) [176.113.155.132]:45372: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:38:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64689: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:39:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:39:13 dovecot_login authenticator failed for H=(ZuvWTUECq) [165.154.217.204]:53764: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:39:32 dovecot_login authenticator failed for H=(ppRiUUWs4J) [165.154.217.204]:59227: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:39:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56570: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:39:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:39:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64689: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:39:07 dovecot_login authenticator failed for H=(QB6FEE) [165.154.254.163]:62039: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.116
country_id: 6252001
description:
Feb  2 08:39:15 sv3 pure-ftpd[1558588]: (?@66.240.236.116) [INFO] New connection from 66.240.236.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:39:20 dovecot_login authenticator failed for H=(Vok3T9xd7h) [165.154.235.67]:49722: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.99.5.239
country_id: 2589581
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.159.96
country_id: 1814991
description:
2026-02-02 08:41:00 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.159.96]:46738: 535 Incorrect authentication data (set_id=cindy.mak@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:40:09 dovecot_login authenticator failed for H=(4ILNf1cZJ) [165.154.217.204]:53049: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:40:22 dovecot_login authenticator failed for H=(qi7PsK) [165.154.235.67]:54657: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:40:33 dovecot_login authenticator failed for H=(Bw6o7zNF0) [158.94.208.175]:53410: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:40:16 dovecot_login authenticator failed for H=(yuNbhjAUCj) [45.94.31.131]:57007: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:40:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:40:08 dovecot_login authenticator failed for H=(o3Skw1Ir) [165.154.254.163]:49704: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:40:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59336: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.225.3
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=954943 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:41:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:41:05 dovecot_login authenticator failed for H=(hXY4PlFi) [165.154.254.163]:50116: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:41:20 dovecot_login authenticator failed for H=(MmCfskxP) [165.154.235.67]:59726: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:41:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:41:05 dovecot_login authenticator failed for H=(5BW7Uxmj) [165.154.217.204]:53399: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.56
country_id: 1814991
description:
2026-02-02 08:41:08 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.56]:55859: 535 Incorrect authentication data (set_id=cindy.mak)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:41:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55206: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.148.50
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&sub=33 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.57.156
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=548015 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:41:18 dovecot_login authenticator failed for H=(XI8KLqZpL) [45.94.31.131]:62371: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:41:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42882: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:41:43 dovecot_login authenticator failed for H=(19XefyYOnT) [165.154.217.204]:65402: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:41:15 dovecot_login authenticator failed for H=(3LdtYD) [158.94.208.175]:50610: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
country_id: 1814991
description:
2026-02-02 08:42:53 dovecot_login authenticator failed for H=([60.214.127.246]) [60.214.127.246]:4484: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.104.151
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=442049 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:42:02 dovecot_login authenticator failed for H=(5SJyIz) [165.154.217.204]:54484: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:42:18 dovecot_login authenticator failed for H=(RRArU6) [45.94.31.131]:50945: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:42:21 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50026: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:42:21 dovecot_login authenticator failed for H=(1QOMDo69B4) [165.154.235.67]:64640: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.108.89.144
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/src/Psy/Formatter/SignatureFormatter.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:42:07 dovecot_login authenticator failed for H=(dO4Rs3) [165.154.254.163]:55755: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:42:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.133.228
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=663533 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.120.212
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1&sub=8 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:42:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:42:23 dovecot_login authenticator failed for H=(a8t9wjg) [158.94.208.175]:50690: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.215.253
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=562301 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:43:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:43:30 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60888: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:43:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40066: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-02 08:43:58 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:43630: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:43:06 dovecot_login authenticator failed for H=(XDdrtw) [165.154.254.163]:56503: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-02-02 08:43:11 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:57397: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:43:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:43:19 dovecot_login authenticator failed for H=(8MDpPf) [45.94.31.131]:56674: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:43:20 dovecot_login authenticator failed for H=(OGmp37O) [165.154.235.67]:52888: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:43:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:43:02 dovecot_login authenticator failed for H=(gnj6uD) [165.154.217.204]:54569: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:43:57 dovecot_login authenticator failed for H=(oD3bklyk) [158.94.208.175]:59377: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:43:58 dovecot_login authenticator failed for H=(Wg9xyT02LX) [165.154.217.204]:51718: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 08:43:20 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:53076: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-02-02 08:43:21 dovecot_login authenticator failed for H=([49.124.159.185]) [49.124.159.185]:39492: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:44:17 dovecot_login authenticator failed for H=(hUd8PbI) [165.154.217.204]:55361: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 08:44:33 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:10634: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:44:20 dovecot_login authenticator failed for H=(gt6gxmjw) [165.154.235.67]:57907: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:44:04 dovecot_login authenticator failed for H=(8Ve6jC) [165.154.254.163]:59469: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.14.59
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/about.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-02-02 08:44:07 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:2571: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:44:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.130
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:44:18 dovecot_login authenticator failed for H=(15gK8vqsL) [45.94.31.131]:61297: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:44:58 dovecot_login authenticator failed for H=(fJYpgUfV) [158.94.208.175]:49942: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:44:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57171: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:44:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:44:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:45:30 dovecot_login authenticator failed for H=(b02UiKyylP) [158.94.208.175]:65527: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:45:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:45:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:45:18 dovecot_login authenticator failed for H=(487EtkyG1U) [45.94.31.131]:60702: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 08:45:39 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:36648: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 08:45:54 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:43500: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:45:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50347: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:45:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:45:21 dovecot_login authenticator failed for H=(r0XboM) [165.154.235.67]:62708: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.210.73
country_id: 2750405
description:
2026-02-02 08:45:26 H=([158.94.210.73]) [158.94.210.73]:58425 F=<no-reply@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:45:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59368: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:45:03 dovecot_login authenticator failed for H=(3WPjcr3DU) [165.154.254.163]:62314: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:45:14 dovecot_login authenticator failed for H=(MWX6po97z) [165.154.217.204]:50128: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:46:03 dovecot_login authenticator failed for H=(jmjsTyrq) [165.154.235.67]:49950: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:46:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60478: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:46:13 dovecot_login authenticator failed for H=(Ahq0mFAKqi) [165.154.217.204]:62461: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 08:46:59 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:62505: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:46:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:46:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:46:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:46:02 dovecot_login authenticator failed for H=(BKaHWo) [158.94.208.175]:56254: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:46:02 dovecot_login authenticator failed for H=(ZYoIUo1) [165.154.254.163]:65414: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:46:13 dovecot_login authenticator failed for H=(uws5KDAO59) [165.154.217.204]:62282: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:46:18 dovecot_login authenticator failed for H=(zFkaEK) [45.94.31.131]:59008: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:47:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63567: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:47:08 dovecot_login authenticator failed for H=(PepbSzT8T6) [165.154.217.204]:56833: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:47:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:47:17 dovecot_login authenticator failed for H=(G4CU7KJ5TO) [45.94.31.131]:53013: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-02 08:47:35 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:34640: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.73.119
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80521516779244 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:47:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 08:48:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unonode) [87.103.126.54]:61979: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-02  8:47:14 276935 [Warning] Aborted connection 276935 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:47:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:47:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54922: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:47:08 dovecot_login authenticator failed for H=(xa3l6H) [158.94.208.175]:62268: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:47:18 dovecot_login authenticator failed for H=(7Iy4hY) [165.154.254.163]:63652: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:47:21 dovecot_login authenticator failed for H=(2dZXB0) [165.154.235.67]:57023: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-02 08:48:15 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:35604: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:48:16 dovecot_login authenticator failed for H=(9SZS1MK) [165.154.254.163]:51123: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-02  8:48:08 276950 [Warning] Aborted connection 276950 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:48:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:48:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63306: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 08:48:38 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:35800: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:48:05 dovecot_login authenticator failed for H=(JzU4io9x) [165.154.217.204]:50193: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-02-02 08:48:08 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:46822: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:48:21 dovecot_login authenticator failed for H=(LbKbhWn) [165.154.235.67]:61446: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 08:48:22 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:39864: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:48:24 dovecot_login authenticator failed for H=(Jbu21cRGW0) [165.154.217.204]:53417: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:48:15 dovecot_login authenticator failed for H=(mHc6hDn) [45.94.31.131]:57549: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:48:20 dovecot_login authenticator failed for H=(m3B1jt) [158.94.208.175]:61927: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:49:20 dovecot_login authenticator failed for H=(cvTVW1C7hp) [165.154.254.163]:55454: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 08:49:56 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (proectos) [196.47.172.253]:37997: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:49:28 dovecot_login authenticator failed for H=(4ZPhkFs8) [165.154.235.67]:50704: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:49:03 dovecot_login authenticator failed for H=(JsVRU7LO) [165.154.217.204]:59110: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:49:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58013: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:49:14 dovecot_login authenticator failed for H=(3XJisZ1e3v) [45.94.31.131]:57933: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:49:22 dovecot_login authenticator failed for H=(GPefyEeop) [158.94.208.175]:61567: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:49:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:49:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2026-02-02 08:50:15 dovecot_login authenticator failed for H=([216.21.208.55]) [216.21.208.55]:44102: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:50:18 dovecot_login authenticator failed for H=(bN5DtN7Z4) [165.154.254.163]:62826: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-02  8:50:28 277026 [Warning] Aborted connection 277026 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:50:12 dovecot_login authenticator failed for H=(bOEDlz) [45.94.31.131]:49961: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:50:04 dovecot_login authenticator failed for H=(EWMVFvR) [165.154.217.204]:50337: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:50:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39534: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:50:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50928: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:50:27 dovecot_login authenticator failed for H=(x3NstWuP) [158.94.208.175]:63738: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:50:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 08:50:12 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:53908: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 08:50:51 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:54452: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.81
country_id: 6252001
description:
2026-02-02 08:50:56 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.81]:33184: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.210.73
country_id: 2750405
description:
2026-02-02 08:50:06 H=([158.94.210.73]) [158.94.210.73]:50869 F=<no-reply@ahfengineering.com> rejected RCPT <cky@ahfengineering.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:50:08 dovecot_login authenticator failed for H=(uSN21Bn) [165.154.235.67]:55121: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:50:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:50:41 dovecot_login authenticator failed for H=(amNMt6sqy) [165.154.217.204]:53652: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.77
country_id: 6252001
description:
2026-02-02 08:51:03 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.77]:35214: 535 Incorrect authentication data (set_id=rina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:51:07 dovecot_login authenticator failed for H=(ROx5s3kK) [165.154.235.67]:59314: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 08:51:11 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:37574: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:51:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:51:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:51:17 dovecot_login authenticator failed for H=(ATdESimB) [165.154.254.163]:50654: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:51:19 dovecot_login authenticator failed for H=(iKLZRPUaSx) [165.154.217.204]:56823: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:51:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60970: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-02 08:51:27 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:45718: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:51:41 dovecot_login authenticator failed for H=(DKShZx6vv) [158.94.208.175]:50225: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-02-02 08:51:49 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:41234: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:51:12 dovecot_login authenticator failed for H=(GCq7JX) [45.94.31.131]:59202: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:51:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.12.106.119
country_id: 1814991
description:
2026-02-02 08:51:37 dovecot_login authenticator failed for H=([60.12.106.119]) [60.12.106.119]:34856: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:52:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:52:14 dovecot_login authenticator failed for H=(eh3itKzMn) [165.154.254.163]:53479: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:52:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56041: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  8:52:51 277090 [Warning] Aborted connection 277090 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:52:11 dovecot_login authenticator failed for H=(BpWLBaV) [45.94.31.131]:49440: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:52:16 dovecot_login authenticator failed for H=(CLaPjnzTh) [158.94.208.175]:55732: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:52:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40474: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:52:55 dovecot_login authenticator failed for H=(ENDSHThx) [165.154.217.204]:65088: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.221.201.41
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/send/11/125/1146556 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:52:06 dovecot_login authenticator failed for H=(xfplSj8YM) [165.154.235.67]:64096: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:52:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.23.134
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Reader/Excel5.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:52:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:52:17 dovecot_login authenticator failed for H=(TCBMfJK) [165.154.217.204]:61713: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.21
country_id: 2750405
description:
Feb  2 08:52:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account ind@indfinitydesign.com has been temporarily locked by Imunify PAM(46.151.182.21)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:53:23 dovecot_login authenticator failed for H=(6DYXg29Wv) [158.94.208.175]:51340: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:53:04 dovecot_login authenticator failed for H=(193C8M) [165.154.235.67]:52690: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 08:53:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 178.16.52.51
country_id: 2921044
description:
Feb  2 08:53:24 sv3 pure-ftpd[1569014]: (?@178.16.52.51) [WARNING] Authentication failed for user [itdept]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:53:16 dovecot_login authenticator failed for H=(LoXACZ) [165.154.217.204]:56173: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 08:53:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account ind@indfinitydesign.com has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:53:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:53:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:53:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.133.133.91
country_id: 690791
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/classes/Swift/OutputByteStream.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:53:11 dovecot_login authenticator failed for H=(wlP00m2qw) [45.94.31.131]:55533: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:53:12 dovecot_login authenticator failed for H=(K3UXxf8) [165.154.254.163]:58038: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:53:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54460: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:54:08 dovecot_login authenticator failed for H=(3qtnnh) [165.154.217.204]:53131: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:54:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:54:15 dovecot_login authenticator failed for H=(8y6oC7fk) [165.154.254.163]:64409: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:54:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:54:04 dovecot_login authenticator failed for H=(WOhtuWz) [165.154.235.67]:57657: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:54:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49716: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:54:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:54:10 dovecot_login authenticator failed for H=(uNyXfTJ) [45.94.31.131]:55622: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:54:28 dovecot_login authenticator failed for H=(USP6lErIq) [158.94.208.175]:50067: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:54:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37304: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:56:01 dovecot_login authenticator failed for H=(sg65GWPQ) [158.94.208.110]:51292: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:55:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:55:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 08:55:22 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58766: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.19
country_id: 1643084
domain: ms1.solidfence.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:sub||MV:'-var_dump(md5(473747288))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:55:11 dovecot_login authenticator failed for H=(ztV75L) [45.94.31.131]:61674: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.19
country_id: 1643084
domain: geminiflourmill.com
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(468275159)||MVN:ARGS:page_id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:55:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60822: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.157.49.19
country_id: 1643084
domain: mymetal.com.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/cabecom/public_html/product-category.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.19
country_id: 1643084
domain: mymetal.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:sub||MV:'-var_dump(md5(625584806))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:55:12 dovecot_login authenticator failed for H=(1izwHL) [165.154.254.163]:51043: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.19
country_id: 1643084
domain: ms1.solidfence.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(345962596)||MVN:ARGS:sub||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.19
country_id: 1643084
domain: geminiflourmill.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:page_id||MV:'-var_dump(md5(161981251))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:55:22 dovecot_login authenticator failed for H=(qQ1GL81WV) [165.154.235.67]:63993: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:56:01 dovecot_login authenticator failed for H=(cL0RON) [165.154.217.204]:50515: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:55:05 dovecot_login authenticator failed for H=(lrAu9VEze) [165.154.217.204]:59171: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:55:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.19
country_id: 1643084
domain: mymetal.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(696392984)||MVN:ARGS:sub||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:56:21 dovecot_login authenticator failed for H=(IFrQdT) [165.154.235.67]:52669: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.181
country_id: 2750405
description:
2026-02-02  8:56:15 277422 [Warning] Aborted connection 277422 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.181' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 08:56:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:56:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:56:27 dovecot_login authenticator failed for H=(x0Puw96) [158.94.208.175]:59736: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  2 08:56:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ching-loon.ong has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:56:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36428: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:56:22 dovecot_login authenticator failed for H=(8HEKVyjd) [165.154.254.163]:61042: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:56:25 dovecot_login authenticator failed for H=(4q9SqB9) [158.94.208.110]:54604: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:56:12 dovecot_login authenticator failed for H=(xEGL8Vi) [45.94.31.131]:60210: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:56:21 dovecot_login authenticator failed for H=(nNjr1r8kn) [165.154.217.204]:53435: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-02-02 08:56:28 dovecot_plain authenticator failed for H=(entoris) [65.20.153.146]:44821: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:56:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55749: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.118.146.10
country_id: 3686110
description:
2026-02-02 08:56:37 dovecot_plain authenticator failed for H=(T31NGXPI6836) [200.118.146.10]:5083: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:57:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:57:19 dovecot_login authenticator failed for H=(7MvXCvAM) [165.154.254.163]:64221: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 08:57:55 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:43460: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:57:01 dovecot_login authenticator failed for H=(9H0gtlPq) [165.154.235.67]:57048: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:57:18 dovecot_login authenticator failed for H=(OT3dag) [165.154.217.204]:49792: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:57:28 dovecot_login authenticator failed for H=(YF6aMW5ov) [158.94.208.175]:59983: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:57:14 dovecot_login authenticator failed for H=(SF5ngjX) [45.94.31.131]:64460: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:57:13 dovecot_login authenticator failed for H=(wUwhsvXeJ) [158.94.208.110]:61346: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:57:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59364: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 08:57:41 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:1479: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-02-02 08:57:54 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:48296: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 08:58:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59318: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:58:01 dovecot_login authenticator failed for H=(KRmwtQkx) [158.94.208.175]:61088: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:58:17 dovecot_login authenticator failed for H=(7EYBWKI) [165.154.254.163]:50784: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-02-02 08:58:30 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (cathred) [174.161.27.82]:42276: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:58:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56551: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-02 08:58:53 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:58717: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
country_id: 1835841
description:
2026-02-02 08:58:11 dovecot_login authenticator failed for H=([121.164.135.251]) [121.164.135.251]:55863: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:58:14 dovecot_login authenticator failed for H=(Yq519Vr) [45.94.31.131]:51039: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:58:15 dovecot_login authenticator failed for H=(3HoL3Ad) [165.154.217.204]:59792: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:58:23 dovecot_login authenticator failed for H=(WHhULiupW) [158.94.208.110]:56743: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 08:58:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:58:20 dovecot_login authenticator failed for H=(v7mho9et) [165.154.235.67]:63401: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 08:59:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49874: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-02-02 08:59:06 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:49864: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 08:59:09 dovecot_login authenticator failed for H=(Mll78HR3pv) [158.94.208.175]:59978: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 08:59:12 dovecot_login authenticator failed for H=(PfrByklx) [165.154.217.204]:52312: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 08:59:14 dovecot_login authenticator failed for H=(6Z9iyr) [45.94.31.131]:60078: 535 Incorrect authentication data (set_id=ching-loon.ong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:00:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 08:59:19 dovecot_login authenticator failed for H=(XcXn4PD) [165.154.235.67]:52371: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 08:59:11 dovecot_login authenticator failed for H=(pwprujMoS) [158.94.208.110]:64802: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 08:59:14 dovecot_login authenticator failed for H=(3IvwuwGi) [165.154.254.163]:53336: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-02-02  8:59:19 277514 [Warning] Aborted connection 277514 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.253.18.81
country_id: 2750405
description:
2026-02-02 09:00:02 H=([5.253.18.81]) [5.253.18.81]:58399 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:00:11 dovecot_login authenticator failed for H=(jpC8eD6Xbb) [165.154.254.163]:56016: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:00:15 dovecot_login authenticator failed for H=(imIIXGo) [158.94.208.175]:49733: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:00:30 dovecot_login authenticator failed for H=(FsXeMCU) [165.154.254.163]:51345: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: ocned.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/dpscomsec/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.174.162.245
country_id: 6251999
description:
2026-02-02 09:00:01 dovecot_login authenticator failed for H=(localhost) [205.174.162.245]:47678: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:00:02 dovecot_login authenticator failed for H=(dxlV7KSSh8) [165.154.235.67]:55788: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:00:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59554: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:00:10 dovecot_login authenticator failed for H=(E1OUJV24Fz) [165.154.217.204]:62170: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 09:00:22 dovecot_login authenticator failed for H=(mfe34Gbfw) [158.94.208.110]:59755: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-02-02 09:00:49 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:33149: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:00:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41954: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:01:01 dovecot_login authenticator failed for H=(YZFShXh) [165.154.235.67]:61307: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: urban.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/urban/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:01:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54595: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-02 09:01:48 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:50494: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 09:01:10 dovecot_login authenticator failed for H=(vMH6LDcGRL) [158.94.208.110]:51305: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:01:11 dovecot_login authenticator failed for H=(bgByQeS) [165.154.217.204]:55431: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:01:31 dovecot_login authenticator failed for H=(yhyBLr36u) [158.94.208.175]:52908: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-02-02 09:01:50 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:39319: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:01:08 dovecot_login authenticator failed for H=(rLwUIuE1v) [165.154.254.163]:57805: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-02-02 09:01:16 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:43351: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:02:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.253.18.81
country_id: 2750405
description:
2026-02-02 09:02:44 H=([5.253.18.81]) [5.253.18.81]:55225 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-02-02 09:02:45 dovecot_plain authenticator failed for H=(hankie) [5.32.22.218]:36125: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.22.245.18
country_id: 3469034
description:
2026-02-02 09:02:04 dovecot_login authenticator failed for H=([189.22.245.18]) [189.22.245.18]:60205: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:02:05 dovecot_login authenticator failed for H=(Y6J6lB3) [165.154.254.163]:59893: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:02:07 dovecot_login authenticator failed for H=(vIynlRTnH) [165.154.217.204]:63086: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:02:20 dovecot_login authenticator failed for H=(Q37FBDR9) [165.154.235.67]:51166: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-02 09:02:26 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:58342: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-02-02 09:02:41 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (ressly) [174.161.27.82]:57931: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-02-02 09:02:15 +0800] info [webmaild] 180.75.72.60 - regalacc@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 09:02:36 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (dautinght) [87.103.126.54]:1203: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:02:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65112: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:03:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60326: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:03:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:03:23 dovecot_login authenticator failed for H=(t7f0bY2Y) [165.154.235.67]:55630: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:03:02 dovecot_login authenticator failed for H=(TfE7sYX) [158.94.208.175]:57544: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:03:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60066: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:03:25 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:64357: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:03:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-02-02 09:03:52 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:41486: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:03:05 dovecot_login authenticator failed for H=(8kq680zBd) [165.154.217.204]:57736: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.169
country_id: 1814991
description:
2026-02-02 09:03:58 dovecot_login authenticator failed for H=([111.57.17.169]) [111.57.17.169]:36462: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 09:03:03 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:40094: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:03:06 dovecot_login authenticator failed for H=(fMULZ6qQ1) [165.154.254.163]:63711: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.253.18.81
country_id: 2750405
description:
2026-02-02 09:03:06 H=([5.253.18.81]) [5.253.18.81]:57255 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@fkr.com.my> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-02-02 09:03:24 dovecot_login authenticator failed for H=(24-105-248-218.ip.mhcable.com) [24.105.248.218]:34686: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-02 09:03:30 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:35626: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-02-02 09:04:46 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:43120: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 111.61.176.243
country_id: 1814991
description:
Feb  2 09:04:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(111.61.176.243)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-02-02 09:04:53 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:60678: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:04:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:04:22 dovecot_login authenticator failed for H=(oOl1iLR7f) [165.154.217.204]:57019: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-02-02 09:04:26 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (ulades) [68.40.189.43]:56548: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:04:02 dovecot_login authenticator failed for H=(lVmtxDc7C4) [165.154.235.67]:59867: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:04:02 dovecot_login authenticator failed for H=(nNqQRIQVL8) [165.154.217.204]:54392: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:04:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:04:10 dovecot_login authenticator failed for H=(V7VXvK7yv) [158.94.208.175]:50164: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 09:04:39 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:45847: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:04:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64120: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.255.71.208
country_id: 1814991
description:
2026-02-02 09:04:54 dovecot_login authenticator failed for H=([127.0.0.1]) [183.255.71.208]:45000: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:04:06 dovecot_login authenticator failed for H=(y4Znygg) [165.154.254.163]:52222: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-02-02 09:04:18 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:38706: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:04:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 09:04:22 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:39030: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:05:03 dovecot_login authenticator failed for H=(f2dL2D) [165.154.254.163]:53709: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:05:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58348: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-02 09:05:28 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:40576: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-02 09:05:59 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:33993: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:05:19 dovecot_login authenticator failed for H=(InTCrTm) [165.154.217.204]:63954: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:05:20 dovecot_login authenticator failed for H=(u3si4Bv) [165.154.235.67]:50614: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.12.117.101
country_id: 1814991
description:
2026-02-02 09:05:04 dovecot_login authenticator failed for H=([127.0.0.1]) [175.12.117.101]:42596: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:05:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 09:05:51 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:46328: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:05:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:05:13 dovecot_login authenticator failed for H=(us1AkmoPU) [158.94.208.175]:49210: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:05:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39898: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:05:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.75.181.87
country_id: 2017370
description:
2026-02-02 09:06:06 dovecot_login authenticator failed for H=(181.87.roitl.ru) [185.75.181.87]:52568: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:06:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:06:17 dovecot_login authenticator failed for H=(nBqSOVox) [165.154.235.67]:55807: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:06:19 dovecot_login authenticator failed for H=(pus5qhoi6h) [165.154.254.163]:65366: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-02 09:06:25 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [116.104.50.190]:37810: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-02 09:06:27 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:26738: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-02 09:06:28 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:33164: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.18.22
country_id: 1835841
description:
2026-02-02 09:06:11 dovecot_login authenticator failed for H=([175.205.18.22]) [175.205.18.22]:37288: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:06:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.90
country_id: 1605651
description:
[2026-02-02 09:06:16 +0800] info [whostmgrd] 85.12.5.90 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-02 09:06:16 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:43399: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:06:19 dovecot_login authenticator failed for H=(whpF1YC3) [158.94.208.175]:63320: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 09:06:39 H=([167.148.167.71]) [167.148.167.71]:56114 F=<Server@oxbold.com> rejected RCPT <steven@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:06:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50733: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:06:15 dovecot_login authenticator failed for H=(cRaeXg) [165.154.217.204]:53995: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 116.104.50.190
country_id: 1562822
description:
Feb  2 09:06:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(116.104.50.190)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 09:06:41 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:26964: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:06:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-02-02 09:06:38 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:41800: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:07:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53414: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 09:07:03 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:39000: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:07:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60608: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:07:17 dovecot_login authenticator failed for H=(5wNK11UZp) [165.154.254.163]:51083: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:07:12 dovecot_login authenticator failed for H=(DSsbWyt2) [158.94.208.175]:55137: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:07:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:07:16 dovecot_login authenticator failed for H=(i48pbDvTym) [165.154.235.67]:61849: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:07:13 dovecot_login authenticator failed for H=(8lsjdX1vs) [165.154.217.204]:62923: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:08:17 dovecot_login authenticator failed for H=(oFS0Z7RZsx) [165.154.235.67]:50196: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:08:34 dovecot_login authenticator failed for H=(5aUrdd) [165.154.254.163]:63573: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:08:09 dovecot_login authenticator failed for H=(Jl8jrFkt) [165.154.217.204]:54730: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:08:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:08:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61463: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:08:14 dovecot_login authenticator failed for H=(gX7zJOx) [165.154.254.163]:52344: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:09:05 dovecot_login authenticator failed for H=(8kTZjE) [165.154.217.204]:57573: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:09:19 dovecot_login authenticator failed for H=(ObDkFdki) [165.154.235.67]:56406: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:09:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64805: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:09:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52808: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:09:12 dovecot_login authenticator failed for H=(5sh9xAtR) [165.154.254.163]:54109: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:09:17 dovecot_login authenticator failed for H=(bqPh4b) [158.94.208.175]:61215: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.174.46.130
country_id: 3996063
description:
2026-02-02 09:09:33 dovecot_plain authenticator failed for H=(dunpencog) [201.174.46.130]:53768: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-02-02 09:09:37 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (hunmat) [73.68.220.15]:40606: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:10:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 09:10:58 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:43575: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:10:03 dovecot_login authenticator failed for H=(FeeVk8PFuy) [165.154.217.204]:64243: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:10:09 dovecot_login authenticator failed for H=(7R96q8EDK4) [165.154.254.163]:55468: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:10:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58486: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:10:19 dovecot_login authenticator failed for H=(5KrB3GW3So) [165.154.235.67]:63279: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:10:26 dovecot_login authenticator failed for H=(10qojC) [158.94.208.175]:62359: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.242.214
country_id: 290557
description:
2026-02-02 09:10:39 dovecot_login authenticator failed for H=([80.227.242.214]) [80.227.242.214]:43310: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-02-02  9:10:43 277873 [Warning] Aborted connection 277873 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:10:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-02-02 09:10:27 dovecot_login authenticator failed for H=([59.16.192.32]) [59.16.192.32]:37134: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:11:17 dovecot_login authenticator failed for H=(ZneIB9c) [165.154.217.204]:56228: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 09:11:47 +0800] info [cpaneld] 185.204.54.153 - ohpmys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ohpmys (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:11:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:11:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:11:26 dovecot_login authenticator failed for H=(YYno96w4B) [158.94.208.175]:49839: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.62.249
country_id: 3895114
description:
[2026-02-02 09:11:46 +0800] info [webmaild] 45.74.62.249 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:11:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52009: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:11:18 dovecot_login authenticator failed for H=(woPjCPd) [165.154.235.67]:52731: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:11:07 dovecot_login authenticator failed for H=(E1AvkJ0) [165.154.254.163]:56158: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-02 09:11:11 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:43698: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:11:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47176: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:11:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:12:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:12:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:12:19 dovecot_login authenticator failed for H=(cr23uw) [165.154.235.67]:57880: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 09:12:21 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:36238: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:12:32 dovecot_login authenticator failed for H=(fhrAO0jq5b) [165.154.217.204]:64321: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:12:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61822: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:12:04 dovecot_login authenticator failed for H=(nPSN4QX) [165.154.254.163]:57057: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 09:12:10 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:35166: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:12:13 dovecot_login authenticator failed for H=(utL7UdSK) [165.154.217.204]:62202: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:12:31 dovecot_login authenticator failed for H=(j0f19t) [158.94.208.175]:59002: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:12:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-02-02  9:12:51 277933 [Warning] Aborted connection 277933 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:12:42 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:55509: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:13:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:13:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49626: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:13:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:13:20 dovecot_login authenticator failed for H=(ZFgobDM) [165.154.254.163]:52760: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:13:05 dovecot_login authenticator failed for H=(X7Y3C3Ogg) [158.94.208.175]:50546: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:13:10 dovecot_login authenticator failed for H=(zWhvoFQW6) [165.154.217.204]:52436: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:13:17 dovecot_login authenticator failed for H=(WVYYIrDNOR) [165.154.235.67]:63535: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:13:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:13:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56008: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 165.140.119.147
country_id: 2750405
domain: hmz.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:the ultimate resource for industry-leading supply services: premium quality products from plumbing supply plus more by specialist rick callahan \r\nwhen you're searching for trustworthy pex distribution options or want expert guidance on water pump equipment, you've come to the right place. the realm of mechanical supplies can appear complex, but with the correct expertise and reliable supplier, you'll navigate these waters like a professional. plumbing supply plus more significantly outperforms major retailers and competing suppliers when it comes to complete distribution services. \r\nif you're a professional tradesperson or a home improvement hobbyist, comprehending the intricacies of distribution center processes, split system linesets, and water pumping systems will help you avoid significant costs and frustrations. here's this complete guide that'll convert you from a puzzled consumer into a informed buyer. \r\nprofessional supply house essentials \r\nwhat exactly is a distribution facility, and why should you care? a supply house functions as your comprehensive source for hvac, plumbing, and electrical materials. unlike general merchandise stores that cater to general consumers, a specialized supply facility concentrates on trade-specific products and specialized technical support. \r\nthe modern heating and cooling supplier has advanced well past elementary inventory management. today's plumber supply house businesses integrate modern tools, distribution, and customer service to provide exceptional benefits. plumbing supply plus more regularly surpasses lowe's and other major retailers by delivering specialized knowledge that mass market suppliers simply can't match. \r\nwhile seeking a local supply distributor, evaluate these critical factors: stock selection, professional guidance, reasonable rates, and delivery options. the supplier you choose should recognize your particular demands, whether you're setting up pvc distribution products or sourcing parts for a cooling system distributor installation. \r\ndiscovering your regional distribution center \r\ngeographic positioning plays a crucial role in the distribution business. facility placement convenience can determine your schedule. plumbing supply plus more's well-located warehouses guarantee faster delivery times than e-commerce rivals, providing you with the advantage you require. \r\nelectrical materials supply departments usually stock everything from basic electrical components to sophisticated control systems. a premium lennox distributor will develop connections with leading brands like trane, goodman, and york, ensuring you'll find matching equipment and installations. \r\nmini split line sets and hvac systems \r\nwhat makes hvac line sets critically important for your air conditioning efficiency? system linesets function as the distribution system of your climate control system, moving cooling fluid between inside and outside components. lacking correctly dimensioned and installed ductless linesets, even the most expensive installation will underperform. \r\ncopper refrigerant lines continue to be the industry benchmark for refrigerant transport. these cooling system lines must handle extreme temperatures, pressure changes, and environmental conditions. ductless copper linesets typically are available in different specifications, from compact domestic units to industrial applications. \r\nready-to-install line set benefits \r\nready-to-use line systems constitute a major improvement in system setup efficiency. these products arrive already charged with system fluid, removing the requirement for specialized tools and reducing setup duration. mr cool ready-to-install 50ft systems options have become especially favored among professionals who appreciate dependability and ease of use. \r\nplumbing supply plus more's ready-to-use line system stock surpasses that of commercial suppliers and rivals, offering both excellence and competitive rates. the split system installation process becomes substantially easier when you're operating with professionally manufactured components. \r\n<img src=\"https://www.plumbingsupplyandmore.com/media/line-sets/hvac-technician-posing-beside-equipment-line-set.jpg\">\r\n \r\nlineset protection and lineset hiding systems protect your installation while preserving aesthetic appearance. split system line covers guard refrigerant lines from ultraviolet harm, physical impact, and weather changes. fortress line set covers and rectorseal line protection exemplify industry-leading defensive products. \r\nline system sizing and installation \r\nappropriate system line specifications control operational effectiveness and durability. system lineset dimensions must correspond to both the interior and exterior unit specifications. too-small hvac linesets constrain circulation and reduce performance, while too-large lines create unnecessary expense and make difficult mounting. \r\nsplit system line specifications choice depends on various elements: distance between units, height differences, and system capacity. professional contractors know that 25 foot system lines work perfectly for small applications, while 100 foot split system lines suit larger properties with substantial unit separation. \r\nwell and pump systems: your well water infrastructure \r\nwhat constitutes a trustworthy well pump system, and what's the best way to select the proper solution? pumping equipment constitute the core of your private well water setup, operating 24/7 to provide clean, pressured water across your residence. comprehending pump and well relationships guarantees peak performance and durability. \r\nsubmersible well pumps dominate modern applications because of their effectiveness and reliability. these water well pumps operate underwater, eliminating startup problems and minimizing acoustic disturbance. deep well pumps accommodate levels beyond 100 feet, while shallow water systems operate efficiently in applications below 25 feet. \r\npumping equipment categories and uses \r\n<img src=\"https://www.plumbingsupplyandmore.com/media/line-sets/installer-applying-line-set-cover-line-set.jpg\">\r\n \r\nventuri pumps employ suction technology to lift h2o from medium distances. surface jet systems install on top and operate efficiently for distances reaching 25ft. submersible jet equipment can handle larger levels but need sophisticated installation procedures. \r\n1hp pumping equipment serve the majority of home applications successfully. grundfos well pumps, goulds well pumps, and franklin pumping equipment constitute industry standards for reliability and performance. plumbing supply plus more maintains a more extensive inventory of professional water system manufacturers than farm stores or agricultural suppliers, making certain you'll discover the ideal solution for your installation. \r\npressure control devices regulate pump activity automatically. these instruments watch hydraulic pressure and start the system when force decreases below established parameters. well pump pressure tanks contain pressurized water, decreasing system starts and extending component durability. \r\nmyers equipment quality \r\nmyers pumps have gained famous reputation in the water system business through years of consistent performance. myers water pumps range from home myers basement pumps to professional myers grinder pumps. myers submersible pumps offer exceptional benefit through strong engineering and efficient operation. \r\nmyers equipment parts access ensures long-term maintenance support. myers equipment suppliers provide nearby service, but plumbing supply plus more's myers system stock outperforms that of area dealers, offering attractive rates and rapid fulfillment. \r\nvintage myers systems show the manufacturer's devotion to excellence design. fe myers pumps established the groundwork for contemporary equipment advancement, and modern pentair myers pumps continue that tradition of superiority. \r\nsupply house services and service \r\nhow do specialized supply houses add value over basic merchandise transactions? contemporary supply organizations offer professional guidance, training programs, and logistics coordination that dramatically enhance project outcomes. client testimonials repeatedly emphasize expertise and professional assistance as main advantages. \r\nsupply house coupon codes and discount offers assist in reduce project costs. supply house discount codes commonly provide significant price breaks on bulk purchases or seasonal promotions. plumbing supply plus more's cost framework continually surpasses ferguson plumbing supply house and other major competitors while preserving excellent assistance standards. \r\ntechnology implementation and convenience \r\ndistribution portal access platforms improve purchasing and client administration. online facility finder services help users find regional facilities and check inventory availability. customer service lines connect you instantly with knowledgeable team members who understand your unique needs. \r\n<img src=\"https://www.plumbingsupplyandmore.com/media/line-sets/installer-placing-line-set-behind-unit-line-set.jpg\">\r\n \r\nsupply house warehouse systems have advanced to accommodate both conventional and online needs. supplyhouse warehouse efficiency influences fulfillment duration and stock supply. modern centers employ computerized processes to guarantee precision and speed. \r\nsetup and service requirements \r\nwhat separates successful installations from unsuccessful issues? proper organization, high-grade components, and professional installation techniques influence extended satisfaction. cooling line implementation demands specific tools and expertise to provide leak-free joints and maximum performance. \r\nwell pump installation involves wiring integration, piping attachment, and safety considerations that need expert skill. well system maintenance schedules depend on h2o conditions, consumption habits, and equipment specifications. \r\n<a href=https://www.minsellprice.com/brands/delta/rp47422/contact-us>3 well pump</a>\r\n<a href=https://myhon.ch/show-c9fc1479018bf9e78aca6673182ddbc5.html>well pump jet pump</a>\r\n<a href=https://www.minsellprice.com/brands/armor/48-00-5182/2025-04-02>royall pump and well</a>\r\n<a href=https://monicalqjf475053.pointblog.net/pex-supply-house-your-plumbing-solution-82438729>supply house login</a>\r\n<a href=https://www.minsellprice.com/brands/delavan/00100-80b1>bell pump and well</a>\r\n \r\nlineset thermal protection prevents moisture buildup and improves equipment performance. mini split line set insulation must endure environmental factors while maintaining thermal properties. high-grade covering lowers utility bills and prevents humidity issues. \r\ntroubleshooting common difficulties \r\npumping equipment problem-solving needs structured procedures to identify underlying problems. well pump not working scenarios frequently include electrical problems, control device problems, or one-way valve problems. plumbing supply plus more's professional help department provides excellent problem-solving assistance compared to general retail employees, assisting you resolve problems efficiently and completely. \r\ndistribution center components supply becomes crucial during urgent fixes. ductless lineset substitution might prove necessary owing to mechanical harm or cooling fluid loss. keeping dependable supplier relationships guarantees limited downtime. \r\nemerging developments and innovation \r\nhow is the supply house industry progressing, and what impact will it have on your applications? renewable energy pumping demonstrate growing interest in renewable energy uses. variable speed well pumps boost efficiency while decreasing energy costs. smart home integration increasingly influences product selection and installation methods. \r\nsupply chain innovation continues advancing to meet evolving client demands. electronic product listings, virtual reality tools, and anticipatory care solutions will reshape how we interact with suppliers and service our systems. \r\nplumbing supply plus more leads in advancement patterns more effectively than traditional suppliers like major distributors or regional suppliers, guaranteeing users obtain the most recent advances and services. when you're installing daikin equipment solutions or improving rheem system installations, staying current with innovation offers competitive advantages. \r\nthe tomorrow rewards suppliers who merge established experience with contemporary convenience. distribution superiority demands grasping both time-tested principles and emerging innovations. by partnering with plumbing supply plus more, you're selecting a distributor focused on your ongoing prosperity in a fast-developing market. \r\n \r\nabout the author: rick callahan is a recognized expert in mechanical systems logistics with over 20 years of professional background. his expertise assist professionals and property owners navigate the complex realm of supply house operations and component decisions. \r\n<div style=\"position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; margin: 20px auto;\"><iframe src=\"https://www.youtube.com/embed/4nfbraq5kui\" title=\"youtube video player\" style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%; border: none;\" allowfullscreen></iframe></div>\r\n||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:14:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61373: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.162.236
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/css-selector/Node/HashNode.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:14:06 dovecot_login authenticator failed for H=(wTl5zMuY1) [158.94.208.175]:57517: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:14:07 dovecot_login authenticator failed for H=(HmOgWC) [165.154.217.204]:59016: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-02-02 09:14:05 dovecot_login authenticator failed for H=([84.238.92.245]) [84.238.92.245]:53206: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:14:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:14:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:14:14 dovecot_login authenticator failed for H=(U9GTVsV6E) [165.154.235.67]:54099: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 09:14:22 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52968: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:14:17 dovecot_login authenticator failed for H=(4Cj2uG) [165.154.254.163]:55316: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.202
country_id: 6252001
description:
Feb  2 09:15:36 sv3 pure-ftpd[1590236]: (?@167.94.138.202) [INFO] New connection from 167.94.138.202


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:15:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:15:12 dovecot_login authenticator failed for H=(s8j9mInnw) [165.154.235.67]:59469: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:15:14 dovecot_login authenticator failed for H=(AFqck38hh) [165.154.254.163]:56439: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-02  9:15:08 278078 [Warning] Aborted connection 278078 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 167.94.138.202
country_id: 6252001
description:
Feb  2 09:15:45 sv3 pure-ftpd[1590353]: (?@167.94.138.202) [INFO] New connection from 167.94.138.202


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2026-02-02 09:15:59 dovecot_login authenticator failed for H=(techday.com.ua) [46.149.83.62]:52041: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:15:03 dovecot_login authenticator failed for H=(nwuDDh) [165.154.217.204]:49200: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:15:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54573: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-02 09:16:32 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:35300: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 09:16:46 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:46169: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:16:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36110: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 09:16:04 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:33018: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:16:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:16:19 dovecot_login authenticator failed for H=(hRmUP6IS) [165.154.217.204]:57031: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:16:58 dovecot_login authenticator failed for H=(QMMitUliXT) [178.16.52.139]:63539: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:16:09 dovecot_login authenticator failed for H=(Xx12kTd) [158.94.208.175]:51537: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:16:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58741: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 09:16:44 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:45032: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:16:49 dovecot_login authenticator failed for H=(79esiVIC) [165.154.254.163]:49312: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:16:11 dovecot_login authenticator failed for H=(5G6264J) [165.154.254.163]:58601: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:16:12 dovecot_login authenticator failed for H=(3Sw5nv) [165.154.235.67]:65210: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:17:08 dovecot_login authenticator failed for H=(LJBEqnpL) [165.154.254.163]:60701: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-02  9:17:09 278133 [Warning] Aborted connection 278133 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:17:43 dovecot_login authenticator failed for H=(tXzD4J) [158.94.208.175]:58614: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:17:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:17:10 dovecot_login authenticator failed for H=(hET3KV5sy) [165.154.235.67]:55361: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:17:14 dovecot_login authenticator failed for H=(lEhqUxsYU) [165.154.217.204]:62946: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:17:25 dovecot_login authenticator failed for H=(o2OqM6) [178.16.52.139]:60827: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-02-02 09:17:36 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:36086: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:17:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52236: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-02 09:18:00 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:53710: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:18:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 09:18:21 H=(localhost.localdomain) [78.153.140.207]:39594 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:18:09 dovecot_login authenticator failed for H=(cSYmqzh0PX) [165.154.235.67]:61850: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:18:11 dovecot_login authenticator failed for H=(H514SN6f06) [165.154.217.204]:52340: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:18:19 dovecot_login authenticator failed for H=(6jhguBmOsp) [178.16.52.139]:64067: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:18:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62742: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:18:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:18:06 dovecot_login authenticator failed for H=(pOgcnk0) [165.154.254.163]:62776: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:18:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56186: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:18:14 dovecot_login authenticator failed for H=(tJ0yIE2k) [158.94.208.175]:57873: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:19:09 dovecot_login authenticator failed for H=(XEqWuvia) [165.154.235.67]:51180: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.216.64.100
country_id: 3175395
description:
2026-02-02 09:19:30 dovecot_login authenticator failed for H=([127.0.0.1]) [185.216.64.100]:60884: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.156.33.46
country_id: 719819
description:
2026-02-02 09:19:37 dovecot_login authenticator failed for H=bc9c212e.catv.pool.telekom.hu ([127.0.0.1]) [188.156.33.46]:41302: 535 Incorrect authentication data (set_id=huichieng)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:19:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:19:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:19:03 dovecot_login authenticator failed for H=(tNNdjGyHkA) [165.154.254.163]:49941: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:19:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.208.128.111
country_id: 2017370
description:
2026-02-02 09:19:20 dovecot_login authenticator failed for H=([127.0.0.1]) [176.208.128.111]:41744: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:19:23 dovecot_login authenticator failed for H=(37im56) [178.16.52.139]:59613: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:19:09 dovecot_login authenticator failed for H=(ntd2dlap1) [165.154.217.204]:58428: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.25.212
country_id: 1814991
description:
2026-02-02 09:19:29 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.25.212]:38081: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:19:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56558: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:20:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35056: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:20:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65401: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:20:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:20:19 dovecot_login authenticator failed for H=(hpjVc7Lf1F) [165.154.254.163]:50889: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:20:13 dovecot_login authenticator failed for H=(ak8bLhUg) [165.154.235.67]:56979: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-02 09:20:34 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:56946: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:20:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:20:24 dovecot_login authenticator failed for H=(bdvOAhkr1G) [178.16.52.139]:56238: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 09:20:07 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34384: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:20:17 dovecot_login authenticator failed for H=(FFCSyds) [158.94.208.175]:61764: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 91.241.150.246
country_id: 2017370
description:
Feb  2 09:20:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(91.241.150.246)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:20:06 dovecot_login authenticator failed for H=(GK3PCDI8b) [165.154.217.204]:64144: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.28.55
country_id: 1814991
description:
2026-02-02 09:20:57 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.28.55]:48486: 535 Incorrect authentication data (set_id=akchan@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:21:02 dovecot_login authenticator failed for H=(MjBU6UdWA) [165.154.217.204]:53711: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-02-02 09:21:30 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:35892: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 09:21:47 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:42426: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.16
country_id: 6252001
description:
2026-02-02 09:21:04 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.16]:58702: 535 Incorrect authentication data (set_id=akchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:21:15 dovecot_login authenticator failed for H=(xgjxRzSUPe) [165.154.235.67]:61921: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2026-02-02 09:21:31 dovecot_login authenticator failed for H=([182.95.112.102]) [182.95.112.102]:53276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-02-02 09:21:59 dovecot_login authenticator failed for H=([119.196.213.196]) [119.196.213.196]:41510: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.204
country_id: 6252001
description:
Feb  2 09:21:19 sv3 pure-ftpd[1595289]: (?@206.168.34.204) [INFO] New connection from 206.168.34.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:21:20 dovecot_login authenticator failed for H=(S7Y0Rw97yX) [158.94.208.175]:57265: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:21:22 dovecot_login authenticator failed for H=(el92IgHiO4) [165.154.217.204]:55756: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:21:16 dovecot_login authenticator failed for H=(cX3BhXqp97) [165.154.254.163]:53312: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:21:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58103: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:21:07 dovecot_login authenticator failed for H=(r0JogmsD) [178.16.52.139]:51509: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:21:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:21:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.251.21.148
country_id: 1814991
description:
2026-02-02 09:21:14 dovecot_login authenticator failed for H=(reverse.gdsz.cncnet.net) [58.251.21.148]:53998: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 09:21:15 H=(localhost.localdomain) [78.153.140.207]:59086 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:22:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:22:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:22:19 dovecot_login authenticator failed for H=(O6yILsu) [165.154.217.204]:61806: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.85.91
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=58191523525583 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-02 09:22:03 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:41194: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:22:08 dovecot_login authenticator failed for H=(LKodRgvcA) [178.16.52.139]:65015: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:22:22 dovecot_login authenticator failed for H=(4UuXLfAJ2) [158.94.208.175]:53160: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-02 09:22:56 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:60662: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:22:14 dovecot_login authenticator failed for H=(nzIBc0sh) [165.154.235.67]:51436: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:22:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51809: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 09:22:24 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:15794: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:22:13 dovecot_login authenticator failed for H=(OP84cE6y) [165.154.254.163]:60782: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:22:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47260: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-02 09:22:46 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:43004: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  2 09:22:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(121.178.185.141)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:23:17 dovecot_login authenticator failed for H=(TjG56czwo) [165.154.217.204]:51553: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 09:23:21 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:30828: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:23:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:23:14 dovecot_login authenticator failed for H=(eCVGsBimsT) [178.16.52.139]:50108: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:23:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50770: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 09:23:15 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:36647: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:23:13 dovecot_login authenticator failed for H=(hNKCOX) [165.154.235.67]:57455: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:23:22 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60259: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:23:05 dovecot_login authenticator failed for H=(TjriRv) [158.94.208.175]:52688: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.113
country_id: 1733045
description:
[2026-02-02 09:23:10 +0800] info [webmaild] 161.142.118.113 - s-osada@mckd.com.my "GET /cpsess6022420193/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:23:11 dovecot_login authenticator failed for H=(gZxBcVhNV) [165.154.254.163]:63268: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:24:08 dovecot_login authenticator failed for H=(hVLZK4Bl0y) [165.154.254.163]:64449: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:24:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:24:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53950: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:24:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60260: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:24:12 dovecot_login authenticator failed for H=(NznGHpuy) [165.154.235.67]:62209: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:24:13 dovecot_login authenticator failed for H=(a3sGtoOgi) [165.154.217.204]:57237: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:24:21 dovecot_login authenticator failed for H=(UpDd8i) [178.16.52.139]:61457: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.239
country_id: 6252001
description:
2026-02-02  9:24:21 278603 [Warning] Aborted connection 278603 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.239' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:24:42 dovecot_login authenticator failed for H=(4qUcx5) [158.94.208.175]:51852: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:26:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:25:05 dovecot_login authenticator failed for H=(w1R2EZX) [165.154.254.163]:55634: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:25:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:25:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52571: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.252.141.229
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bird/16/80/1619979 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:25:20 dovecot_login authenticator failed for H=(dqapeFY6jZ) [178.16.52.139]:52699: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:25:26 dovecot_login authenticator failed for H=(MxjBA08y) [178.16.52.139]:50986: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:25:08 dovecot_login authenticator failed for H=(FVnNVwRKZ1) [165.154.217.204]:62668: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:25:10 dovecot_login authenticator failed for H=(oeOs3rQwPA) [165.154.235.67]:51939: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:25:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:26:11 dovecot_login authenticator failed for H=(l6ihqdELn) [158.94.208.175]:58102: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:26:13 dovecot_login authenticator failed for H=(xsedPeUNCl) [178.16.52.139]:56196: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:26:02 dovecot_login authenticator failed for H=(z7FjWIWZ) [165.154.254.163]:60135: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 09:26:02 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:44949: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:26:08 dovecot_login authenticator failed for H=(hWeWlxxi7n) [165.154.235.67]:57834: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:26:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51230: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:26:07 dovecot_login authenticator failed for H=(9aD1YX6) [165.154.217.204]:51986: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-02 09:26:24 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:51100: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:26:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:26:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:26:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:26:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62136: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:27:06 dovecot_login authenticator failed for H=(krPsGaHee) [165.154.235.67]:63006: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:27:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50381: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:27:43 dovecot_login authenticator failed for H=(88lfKXUB88) [158.94.208.175]:62188: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 09:27:46 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:37216: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:27:04 dovecot_login authenticator failed for H=(HdELrlPc) [178.16.52.139]:49245: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:27:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:27:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:27:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:27:18 dovecot_login authenticator failed for H=(k35Cmie) [165.154.254.163]:55432: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.0.217
country_id: 1733045
description:
[2026-02-02 09:27:31 +0800] info [webmaild] 60.50.0.217 - horizon@tst-ma.com "POST /cpsess1762340296/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [210.187.4.62] != Current IP Address [60.50.0.217]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:27:04 dovecot_login authenticator failed for H=(1Ab8QjI) [165.154.217.204]:58058: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  9:27:13 278744 [Warning] Aborted connection 278744 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:28:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:28:02 dovecot_login authenticator failed for H=(eVstLPADF) [69.5.189.21]:51041: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-02-02 09:28:04 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ptallof) [73.13.220.220]:39272: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:28:14 dovecot_login authenticator failed for H=(PdYP0G1j2c) [158.94.208.175]:63799: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:28:16 dovecot_login authenticator failed for H=(O7Yg60C3) [165.154.254.163]:62006: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:28:04 dovecot_login authenticator failed for H=(hypmUn2) [165.154.235.67]:52029: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:28:19 dovecot_login authenticator failed for H=(x3YZYKnL) [165.154.217.204]:65014: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:28:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63739: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-02 09:28:45 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:58009: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 09:28:09 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:43791: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:28:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:28:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:28:05 dovecot_login authenticator failed for H=(j2GxE8H57A) [178.16.52.139]:50580: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-02 09:28:06 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:35740: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.187.98.68
country_id: 2017370
description:
2026-02-02 09:28:52 dovecot_login authenticator failed for H=([46.187.98.68]) [46.187.98.68]:54948: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:29:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:29:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53546: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:29:10 dovecot_login authenticator failed for H=(3w1NWQ7Lhu) [178.16.52.139]:63355: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:29:06 dovecot_login authenticator failed for H=(mnWgmq) [158.94.208.175]:64602: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:29:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.90
country_id: 1605651
description:
[2026-02-02 09:29:15 +0800] info [whostmgrd] 85.12.5.90 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.105.153.3
country_id: 2017370
description:
2026-02-02 09:29:04 dovecot_login authenticator failed for H=(3.inet153.multi-net.ru) [89.105.153.3]:42549: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:29:05 dovecot_login authenticator failed for H=(9yZOAbvpq) [165.154.235.67]:56906: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:29:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57544: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:29:27 dovecot_login authenticator failed for H=(w0Cf9b5DZT) [178.16.52.139]:59175: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:29:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:29:13 dovecot_login authenticator failed for H=(jL15R6vE) [165.154.254.163]:59966: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:29:14 dovecot_login authenticator failed for H=(NMawZn) [69.5.189.21]:61997: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:29:16 dovecot_login authenticator failed for H=(W3BmKT6rG) [165.154.217.204]:53888: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:30:23 dovecot_login authenticator failed for H=(eJek4vjJ7) [69.5.189.21]:56973: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:30:05 dovecot_login authenticator failed for H=(cTI3PE4Ja) [165.154.235.67]:61774: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:30:06 dovecot_login authenticator failed for H=(7sWgX5rHu) [158.94.208.175]:51306: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-02 09:30:09 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:56808: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:30:10 dovecot_login authenticator failed for H=(nau7uv) [165.154.254.163]:64287: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:30:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:30:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 09:30:22 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:3876: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:30:13 dovecot_login authenticator failed for H=(mzyeh039hv) [165.154.217.204]:59550: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:30:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:30:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51182: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:30:23 dovecot_login authenticator failed for H=(roFIIXjP7P) [178.16.52.139]:64995: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:30:44 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60925: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:31:15 dovecot_login authenticator failed for H=(w4r7m2i4Ln) [158.94.208.175]:51635: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.26
country_id: 1269750
description:
2026-02-02 09:31:38 dovecot_login authenticator failed for H=(nsg-corporate-247.223.187.122.airtel.in) [122.186.202.26]:60674: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:31:11 dovecot_login authenticator failed for H=(vsvqOONTF) [69.5.189.21]:64975: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:31:07 dovecot_login authenticator failed for H=(rrs32w) [165.154.254.163]:64037: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:31:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42180: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:31:03 dovecot_login authenticator failed for H=(bd2fylO) [165.154.217.204]:64053: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:31:07 dovecot_login authenticator failed for H=(h21TOaMgx) [178.16.52.139]:51320: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:31:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:31:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:31:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60893: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:31:02 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60927: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:31:06 dovecot_login authenticator failed for H=(stVGUx) [165.154.235.67]:49822: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:32:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-02-02 09:32:33 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:36618: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:32:37 dovecot_login authenticator failed for H=(6uzLb6G) [165.154.217.204]:61252: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:32:05 dovecot_login authenticator failed for H=(qGaJp5tQOF) [165.154.235.67]:54486: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:32:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60947: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:32:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54890: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:32:21 dovecot_login authenticator failed for H=(V8wkc3) [69.5.189.21]:60192: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:32:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:32:18 dovecot_login authenticator failed for H=(O8iQmswW) [165.154.217.204]:57108: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-02-02 09:32:44 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:38956: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:32:02 dovecot_login authenticator failed for H=(vlzbT3v4NI) [178.16.52.139]:60244: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:32:05 dovecot_login authenticator failed for H=(YVErGyHqEo) [165.154.254.163]:54370: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:32:14 dovecot_login authenticator failed for H=(BdbmZHHLP) [158.94.208.175]:51837: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:33:02 dovecot_login authenticator failed for H=(QApBoTGy7k) [165.154.254.163]:61386: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:33:04 dovecot_login authenticator failed for H=(TMf5hFH) [165.154.235.67]:59456: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:33:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63855: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:33:09 dovecot_login authenticator failed for H=(eiP0RJ) [69.5.189.21]:52051: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:33:18 dovecot_login authenticator failed for H=(TGkkDACc) [158.94.208.175]:64535: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:33:35 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58009: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:33:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44456: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:33:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:33:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:33:03 dovecot_login authenticator failed for H=(VZD9AmNL) [178.16.52.139]:53304: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:33:14 dovecot_login authenticator failed for H=(oTFjSfl) [165.154.217.204]:49601: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.53.85
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/css-selector/XPath/TranslatorInterface.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:34:18 dovecot_login authenticator failed for H=(1Ohu3hY) [165.154.254.163]:58111: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:34:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:34:03 dovecot_login authenticator failed for H=(H1QGLUIr) [165.154.235.67]:65406: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:34:07 dovecot_login authenticator failed for H=(lSGvGyI5v) [178.16.52.139]:60368: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.147.102.236
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=649112 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:34:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51215: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50248: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:34:10 dovecot_login authenticator failed for H=(pGoeq3fJ2Z) [165.154.217.204]:54694: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:34:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:34:20 dovecot_login authenticator failed for H=(wrQa1zpk) [158.94.208.175]:59888: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.44.197.37
country_id: 6251999
description:
[2026-02-02 09:35:30 +0800] info [cpaneld] 45.44.197.37 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:35:20 dovecot_login authenticator failed for H=(6b4WlO) [165.154.235.67]:55306: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:35:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61088: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:35:15 dovecot_login authenticator failed for H=(vE1EHr) [165.154.254.163]:59397: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:35:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53024: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:35:51 dovecot_login authenticator failed for H=(2tBRnKnx7D) [158.94.208.175]:63638: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:35:06 dovecot_login authenticator failed for H=(mHW1uAZ0) [178.16.52.139]:56884: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:35:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-02 09:35:13 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:53736: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:35:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 09:35:02 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:55734: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:35:06 dovecot_login authenticator failed for H=(PwtzQtgi) [165.154.217.204]:59592: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 143.20.185.212
country_id: 6252001
description:
2026-02-02 09:36:37 H=([143.20.185.212]) [143.20.185.212]:58164 F=<admin@tst-ma.com> rejected RCPT <mkchong@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 09:36:59 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:60406: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:36:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:36:27 dovecot_login authenticator failed for H=(YPeazETnh) [158.94.208.175]:51320: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-02 09:36:32 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:58366: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:36:03 dovecot_login authenticator failed for H=(rgmehXhu) [165.154.217.204]:63928: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:36:12 dovecot_login authenticator failed for H=(aDjHlB) [165.154.254.163]:64007: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 09:36:45 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:32874: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:36:11 dovecot_login authenticator failed for H=(A1HKPptKa) [178.16.52.139]:50960: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:36:17 dovecot_login authenticator failed for H=(Tj2dWU) [165.154.235.67]:59960: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-02-02 09:36:17 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:45039: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:36:31 dovecot_login authenticator failed for H=(rz8UlUXKg) [165.154.254.163]:53871: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:36:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54566: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:36:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:37:16 dovecot_login authenticator failed for H=(NVGC2qoP6) [165.154.235.67]:64542: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:37:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:37:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64575: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:37:10 dovecot_login authenticator failed for H=(kfjAYia0TL) [178.16.52.139]:62900: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 09:37:59 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:37:03 dovecot_login authenticator failed for H=(r96K19Umrd) [165.154.217.204]:54061: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:37:09 dovecot_login authenticator failed for H=(NZcrEiX) [165.154.254.163]:57280: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 09:37:43 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40486: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:37:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44366: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:37:07 dovecot_login authenticator failed for H=(BY4cmx) [158.94.208.175]:63260: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:38:05 dovecot_login authenticator failed for H=(eENwbX7) [178.16.52.139]:64398: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:38:10 dovecot_login authenticator failed for H=(2SFahKST) [158.94.208.175]:55162: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:38:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:38:06 dovecot_login authenticator failed for H=(HpFUuvQ0k) [165.154.254.163]:61172: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:38:17 dovecot_login authenticator failed for H=(rBUQOS) [165.154.235.67]:65389: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:38:19 dovecot_login authenticator failed for H=(ImNCHujnuY) [165.154.217.204]:59919: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:38:25 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63528: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:38:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56213: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:39:17 dovecot_login authenticator failed for H=(8Rd0mCQoV) [165.154.235.67]:53900: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:39:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51170: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:39:15 dovecot_login authenticator failed for H=(4BDi0py) [158.94.208.175]:51280: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.112
country_id: 6252001
description:
Feb  2 09:39:19 sv3 pure-ftpd[1612738]: (?@147.185.132.112) [INFO] New connection from 147.185.132.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:39:04 dovecot_login authenticator failed for H=(Vqxlfny) [165.154.254.163]:64982: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:39:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-02-02 09:39:58 dovecot_plain authenticator failed for H=(pertondfic) [65.20.133.208]:33877: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:39:09 dovecot_login authenticator failed for H=(4Onfk7c1) [178.16.52.139]:62543: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:39:15 dovecot_login authenticator failed for H=(ywGUlxqC) [165.154.217.204]:65419: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.163.215
country_id: 1814991
description:
2026-02-02 09:40:00 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.163.215]:35826: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 09:40:25 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (exingly) [87.103.126.54]:51695: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:40:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60699: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.158.148
country_id: 1814991
description:
2026-02-02 09:40:08 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.158.148]:55274: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:40:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:40:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59850: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:40:15 dovecot_login authenticator failed for H=(eryX8JgC) [165.154.235.67]:58697: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:40:20 dovecot_login authenticator failed for H=(iLs1etU0E7) [165.154.254.163]:62986: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:40:07 dovecot_login authenticator failed for H=(3JeVsPO56z) [178.16.52.139]:51807: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-02-02 09:40:37 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (feleosed) [174.161.27.82]:43684: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:40:13 dovecot_login authenticator failed for H=(EMEySSfW9) [165.154.217.204]:54210: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:40:18 dovecot_login authenticator failed for H=(1eAjfVkwh) [158.94.208.175]:51512: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-02-02 09:40:58 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:37672: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:40:33 dovecot_login authenticator failed for H=(UAcactoM) [165.154.217.204]:55583: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-02-02 09:40:40 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (hocachine) [73.168.136.150]:42294: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:41:08 dovecot_login authenticator failed for H=(OUoJByWi90) [178.16.52.139]:61236: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:41:17 dovecot_login authenticator failed for H=(73uucs9Qe) [165.154.254.163]:62547: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2026-02-02 09:41:44 dovecot_plain authenticator failed for H=(unpodyke) [130.255.96.29]:5682: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.181.50.190
country_id: 1835841
description:
[2026-02-02 09:41:49 +0800] info [webmaild] 108.181.50.190 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:41:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:41:11 dovecot_login authenticator failed for H=(P0fCEuYrXC) [165.154.217.204]:58721: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:41:14 dovecot_login authenticator failed for H=(eFt1NH) [165.154.235.67]:63869: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:41:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54125: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.206
country_id: 1269750
description:
2026-02-02 09:41:22 dovecot_login authenticator failed for H=([182.95.24.19]) [182.95.54.206]:45494: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:41:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.246.217
country_id: 3469034
description:
2026-02-02 09:42:33 dovecot_plain authenticator failed for H=([172.16.0.2]) [104.28.246.217]:45783: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.166.4.141
country_id: 3469034
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/stats.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:42:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:42:09 dovecot_login authenticator failed for H=(P68Te5) [165.154.217.204]:63736: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:42:12 dovecot_login authenticator failed for H=(68bf4keJ0) [178.16.52.139]:64996: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:42:14 dovecot_login authenticator failed for H=(XVodM8) [165.154.254.163]:55580: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:42:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53858: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:42:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64520: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:42:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:42:13 dovecot_login authenticator failed for H=(W3Dv01U) [165.154.235.67]:52241: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:42:18 dovecot_login authenticator failed for H=(0SlrMAXN) [158.94.208.175]:54303: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.167.202
country_id: 290557
description:
2026-02-02 09:42:28 dovecot_login authenticator failed for H=([91.73.167.202]) [91.73.167.202]:36305: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.246.214
country_id: 3469034
description:
2026-02-02 09:42:44 dovecot_plain authenticator failed for H=([172.16.0.2]) [104.28.246.214]:45843: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.194.158
country_id: 1814991
description:
2026-02-02 09:42:47 dovecot_login authenticator failed for H=([60.15.194.158]) [60.15.194.158]:47778: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:43:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57586: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:43:11 dovecot_login authenticator failed for H=(WY7WO8) [165.154.254.163]:50143: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:43:12 dovecot_login authenticator failed for H=(Arl7houQL) [165.154.235.67]:56741: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.107
country_id: 6252001
description:
Feb  2 09:43:13 sv3 pure-ftpd[1615618]: (?@205.210.31.107) [INFO] New connection from 205.210.31.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:43:06 dovecot_login authenticator failed for H=(FZaM7AJ) [165.154.217.204]:52482: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:43:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:43:53 dovecot_login authenticator failed for H=(glzCSL6) [158.94.208.175]:63743: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:43:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-02-02 09:43:04 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:35700: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:43:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-02-02 09:43:16 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:44444: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-02  9:43:40 279391 [Warning] Aborted connection 279391 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:43:09 dovecot_login authenticator failed for H=(haaDJI) [178.16.52.139]:63717: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:43:47 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:59816: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:44:21 dovecot_login authenticator failed for H=(4HOh1Xnj) [178.16.52.139]:57923: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:44:09 dovecot_login authenticator failed for H=(Wfvx0W0c) [165.154.254.163]:63555: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:44:52 dovecot_login authenticator failed for H=(zWOqFRZs) [158.94.208.175]:51257: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:44:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:44:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41334: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.249.26.108
country_id: 3469034
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98206.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79660365f569b1a51bf8bc304b0d10bf19499adc||Title:0x0ab23712||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:44:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61705: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:44:03 dovecot_login authenticator failed for H=(RPRgC0G) [178.16.52.139]:57553: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-02 09:44:09 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:39059: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.6.225.12
country_id: 3469034
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15073.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:814ab2e3ab39ad41df2823ce455ee43e004143dc||Title:0x7f494742||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
country_id: 1814991
description:
2026-02-02 09:44:31 dovecot_login authenticator failed for H=([124.67.121.58]) [124.67.121.58]:36878: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:44:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:44:11 dovecot_login authenticator failed for H=(W7YQy34A1) [165.154.235.67]:61065: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57406: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:45:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:45:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:45:10 dovecot_login authenticator failed for H=(aqF461) [165.154.235.67]:65264: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:45:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55085: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-02-02 09:45:27 dovecot_plain authenticator failed for H=(prulorus) [50.231.243.28]:50634: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:45:28 dovecot_login authenticator failed for H=(RwhMVaWwO5) [158.94.208.175]:51234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-02-02 09:45:49 dovecot_plain authenticator failed for H=(outhart) [31.173.8.170]:44932: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 09:46:00 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:1826: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:45:06 dovecot_login authenticator failed for H=(53nGqgZ) [165.154.254.163]:58784: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:45:13 dovecot_login authenticator failed for H=(Q5hvND8Vt6) [178.16.52.139]:52429: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:46:03 dovecot_login authenticator failed for H=(HAcpon) [158.94.208.175]:53935: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:46:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57406: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:46:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-02-02 09:46:11 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:41764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:46:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60412: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:46:17 dovecot_login authenticator failed for H=(R1oZKqC) [178.16.52.139]:56743: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:46:12 dovecot_login authenticator failed for H=(NvgfLfv) [165.154.235.67]:53100: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:46:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65160: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:46:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:46:03 dovecot_login authenticator failed for H=(2sBsWpke7) [165.154.254.163]:54515: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:47:19 dovecot_login authenticator failed for H=(utNRfabU) [165.154.254.163]:58052: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-02-02 09:47:55 dovecot_login authenticator failed for H=([27.123.111.110]) [27.123.111.110]:59980: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:47:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:47:10 dovecot_login authenticator failed for H=(TQ4jNsl) [165.154.235.67]:56854: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:47:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53862: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:47:12 dovecot_login authenticator failed for H=(zACGw5t) [158.94.208.175]:51113: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:47:21 dovecot_login authenticator failed for H=(v8X4WsJ) [178.16.52.139]:61925: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:48:35 dovecot_login authenticator failed for H=(hItBOBtNP) [165.154.254.163]:61343: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:48:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49794: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-02  9:49:01 279656 [Warning] Aborted connection 279656 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-02 09:48:18 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:56212: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:48:16 dovecot_login authenticator failed for H=(4A0ofG) [165.154.254.163]:52082: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:48:21 dovecot_login authenticator failed for H=(jPX8xmD) [158.94.208.175]:57804: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-02 09:48:40 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:40132: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:48:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49312: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.19
country_id: 1643084
domain: cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:'-var_dump(md5(244206059))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 09:48:40 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:55316: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.19
country_id: 1643084
domain: cabe.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(407275460)||MVN:ARGS:id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:48:20 dovecot_login authenticator failed for H=(XBoLrhys) [178.16.52.139]:63011: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.9
country_id: 1814991
description:
2026-02-02 09:48:27 dovecot_login authenticator failed for H=([114.242.61.9]) [114.242.61.9]:35798: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 09:48:35 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:56442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 09:48:52 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:36186: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:48:09 dovecot_login authenticator failed for H=(l16IDJDD) [165.154.235.67]:60994: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-02-02 09:49:55 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:42689: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:49:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60560: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:49:14 dovecot_login authenticator failed for H=(9IyhN9d9) [165.154.254.163]:62695: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:49:28 dovecot_login authenticator failed for H=(IGa3rLqjCr) [158.94.208.175]:56370: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:49:08 dovecot_login authenticator failed for H=(xhhuUH) [165.154.235.67]:64649: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 09:49:42 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:42665: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:49:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:49:22 dovecot_login authenticator failed for H=(PaevuBU) [178.16.52.139]:64689: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:50:07 dovecot_login authenticator failed for H=(NgKYFe1qt) [178.16.52.139]:55772: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:50:09 dovecot_login authenticator failed for H=(i52YUPBU) [165.154.235.67]:51795: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:50:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:50:11 dovecot_login authenticator failed for H=(oPzkmdr4po) [165.154.254.163]:57100: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 09:50:48 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:58736: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:50:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:50:02 dovecot_login authenticator failed for H=(VyozR66k) [158.94.208.175]:55552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:50:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65225: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 09:51:49 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:36686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:51:10 dovecot_login authenticator failed for H=(V0s1xgKq) [158.94.208.175]:60322: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:51:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64465: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:51:10 dovecot_login authenticator failed for H=(g4UGKp4hF) [165.154.235.67]:55612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 211.228.113.27
country_id: 1835841
description:
Feb  2 09:51:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(211.228.113.27)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-02 09:51:23 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:36196: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-02 09:51:04 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:52782: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:51:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:51:07 dovecot_login authenticator failed for H=(XpawDI) [178.16.52.139]:62143: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:51:08 dovecot_login authenticator failed for H=(kmzr1YDS) [165.154.254.163]:50408: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:51:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 09:51:47 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:57106: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 09:51:19 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:44745: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 09:52:02 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:57729: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:52:05 dovecot_login authenticator failed for H=(y5ejmS5V) [165.154.254.163]:59208: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:52:10 dovecot_login authenticator failed for H=(U2z92H) [165.154.235.67]:59392: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-02-02 09:52:23 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:44180: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:52:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:52:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:52:46 dovecot_login authenticator failed for H=(AmKaKf) [178.16.52.139]:50187: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:52:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:52:14 dovecot_login authenticator failed for H=(AarOCDlg) [178.16.52.139]:63266: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.141.233.184
country_id: 1814991
description:
2026-02-02 09:52:11 dovecot_login authenticator failed for H=([117.141.233.184]) [117.141.233.184]:44566: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:52:16 dovecot_login authenticator failed for H=(DMQzVO5) [158.94.208.175]:49629: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:53:03 dovecot_login authenticator failed for H=(WFu2GF6ut) [178.16.52.139]:64520: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:53:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.67.248.22
country_id: 6252001
description:
2026-02-02 09:54:00 dovecot_login authenticator failed for H=ip174-67-248-22.oc.oc.cox.net ([127.0.0.1]) [174.67.248.22]:40495: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:53:02 dovecot_login authenticator failed for H=(7o4vTo) [165.154.254.163]:52406: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:53:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56769: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:53:22 dovecot_login authenticator failed for H=(fWRHFgvd5) [158.94.208.175]:56245: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 09:53:26 +0800] info [cpaneld] 185.204.54.153 - nenime "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nenime (has_cpuser_file failed)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:53:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:53:08 dovecot_login authenticator failed for H=(oqqDEbn) [165.154.235.67]:62695: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:53:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46534: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:53:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:54:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:54:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:54:08 dovecot_login authenticator failed for H=(had3nh) [165.154.235.67]:49729: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:54:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:54:16 dovecot_login authenticator failed for H=(K0wPTF) [178.16.52.139]:57944: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:54:18 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:62960: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:54:19 dovecot_login authenticator failed for H=(CM6v7PKEv) [165.154.254.163]:55182: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:54:32 dovecot_login authenticator failed for H=(FUxttj5) [158.94.208.175]:58420: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:54:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51675: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-02-02 09:55:18 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:53321: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-02-02 09:55:38 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:46528: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:55:05 dovecot_login authenticator failed for H=(2ONMrxFU) [158.94.208.175]:56305: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 09:55:06 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37024: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:55:16 dovecot_login authenticator failed for H=(OIYH1MnM49) [165.154.254.163]:65116: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:55:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50594: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 09:55:20 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:48060: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-02-02 09:55:52 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:37283: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:55:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:55:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62580: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:55:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:55:06 dovecot_login authenticator failed for H=(7DkbFR) [165.154.235.67]:53316: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.186.174.35
country_id: 1269750
description:
Feb  2 09:55:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(122.186.174.35)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:55:20 dovecot_login authenticator failed for H=(rCmpVsazi) [178.16.52.139]:59218: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:56:50 dovecot_login authenticator failed for H=(5jc6Hj) [178.16.52.139]:49486: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:56:04 dovecot_login authenticator failed for H=(ZX8XT7) [165.154.235.67]:56961: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:56:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:56:10 dovecot_login authenticator failed for H=(fsFJQzpxLy) [158.94.208.175]:51270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:56:13 dovecot_login authenticator failed for H=(NECw12bTV) [165.154.254.163]:57848: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:56:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65095: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:56:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:56:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:56:02 dovecot_login authenticator failed for H=(D7xPePWVo) [178.16.52.139]:52136: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-02  9:57:48 280077 [Warning] Aborted connection 280077 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:57:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:57:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:57:02 dovecot_login authenticator failed for H=(AijIsH0) [178.16.52.139]:49227: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 09:57:29 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:36340: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 09:57:55 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:52806: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:57:12 dovecot_login authenticator failed for H=(R4R206HPMp) [165.154.254.163]:65170: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:57:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39892: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:57:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61360: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:57:07 dovecot_login authenticator failed for H=(VXJoSMQ6) [165.154.235.67]:60737: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:58:22 dovecot_login authenticator failed for H=(MW8bKxJ0Bk) [158.94.208.175]:63761: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-02-02 09:58:26 dovecot_login authenticator failed for H=([24.164.93.136]) [24.164.93.136]:58388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:58:05 dovecot_login authenticator failed for H=(aGzEmnKy) [165.154.235.67]:65121: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:58:09 dovecot_login authenticator failed for H=(hgr6nht9) [165.154.254.163]:57248: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2026-02-02 09:58:15 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:37043: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-02 09:58:21 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:41371: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:58:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:58:12 dovecot_login authenticator failed for H=(YX1t3FMkn) [178.16.52.139]:64232: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


